switchport nonegotiate is a Cisco IOS interface command that prevents a switch port from sending Dynamic Trunking Protocol (DTP) messages. Disabling DTP reduces unnecessary traffic and blocks attackers from negotiating an unauthorized trunk to access multiple VLANs. section 13.1.2
Use the command as part of explicit port configuration:
- Configure the port’s intended mode with switchport mode access or switchport mode trunk. section 13.1.2
- Enter switchport nonegotiate so the port does not send DTP, even when later configured as a trunk. section 13.1.2
- Treat disabling DTP on each port as a security best practice. section 13.3
Disable DTP on a trunk
SW1(config)# interface g0/0 SW1(config-if)# switchport mode trunk SW1(config-if)# switchport nonegotiate SW1(config-if)# do show interfaces g0/0 switchport ... Administrative Mode: trunk Operational Mode: trunk Negotiation of Trunking: Off The port remains a trunk, but DTP negotiation is disabled. section 13.1.2
Figure 13.3 An attacker sends malicious DTP messages to SW1 to form a trunk. This gives the attacker access to all VLANs in the LAN, presenting a security threat.
Visualizes how malicious DTP messages can negotiate a trunk and expose all VLANs. section 13.1.2
