switchport mode dynamic auto configures a Cisco switch port to use DTP while passively negotiating its operational mode. The port normally remains access mode; it becomes a trunk only when the neighbor is configured as trunk or dynamic desirable. Two dynamic auto ports therefore form an access link. section 13.1.1 section 13.3
Remember these operational points:
- dynamic auto is the default administrative mode on Cisco switch ports. section 13.1.1
- The port sends DTP messages but does not actively try to form a trunk. section 13.1.1
- Use show interfaces interface-name switchport to compare administrative mode with operational mode. section 13.1.1
- Treat dynamic auto as a security risk: a user who sends malicious DTP messages can negotiate a trunk and gain access to all VLANs. section 13.1.2
Verify a default port
On SW1, show interfaces g0/0 switchport can report Administrative Mode: dynamic auto and Operational Mode: static access. To avoid negotiation, manually configure the intended mode and use switchport nonegotiate. section 13.1.2
