Dynamic Trunking Protocol (DTP) is a Cisco-proprietary protocol that lets neighboring Cisco switches exchange messages and determine whether connected ports operate as access ports or trunk ports. Administrative mode is the configured setting; operational mode is how the port actually functions. DTP does not work with switches from other vendors, and router-connected switch ports require manual trunk configuration. section 13.1 section 13.1.1
Use these administrative modes to predict DTP behavior:
- access: Forces operational access mode and sends no DTP messages. section 13.1.1
- trunk: Forces operational trunk mode and sends DTP messages unless negotiation is disabled. section 13.1.1 section 13.1.2
- dynamic auto: Waits for the neighbor; forms a trunk with trunk or dynamic desirable, but not with another dynamic auto port. section 13.1.1
- dynamic desirable: Actively attempts to form a trunk and succeeds with trunk, dynamic auto, or dynamic desirable. section 13.1.1
Verify and disable DTP
Check a port with show interfaces g0/0 switchport. Administrative Mode and Operational Mode reveal configured and active behavior, while Negotiation of Trunking shows whether DTP is sending messages. For a host-facing port, use switchport mode access and switchport nonegotiate. For a manually configured trunk, use switchport mode trunk followed by switchport nonegotiate. Disabling DTP reduces unnecessary traffic and prevents an attacker from negotiating a trunk to reach multiple VLANs. section 13.1.1 section 13.1.2
Table 13.2 Switch port administrative modes (view table figure)
| Administrative modes |
access |
trunk |
dynamic desirable |
dynamic auto |
|---|---|---|---|---|
| Access |
access |
invalid |
access |
access |
| Trunk |
invalid |
trunk |
trunk |
trunk |
| Dynamic desirable |
access |
trunk |
trunk |
trunk |
| Dynamic auto |
access |
trunk |
trunk |
access |
Compare every pair of administrative modes and identify whether the resulting operational mode is access or trunk. section 13.1.1
