VTP (VLAN Trunking Protocol) – Concepts & Operation

1) VTP Overview

• VTP helps manage VLANs from a central switch (VTP server).

• The server distributes VLAN information to other switches.

• This happens over trunk links.

• All VTP-enabled switches stay synchronized.

2) VTP Components

• VTP Domain

• A group of connected switches.

• All switches share VLAN information.

• Switches in different domains do NOT communicate with each other.

• VTP Advertisements

• Messages used to share VLAN information.

• Sent periodically through trunk ports to a multicast address.

• Neighbor switches receive and update their VLAN configuration.

• A router or Layer 3 switch defines the domain boundary.

• VTP Password

• Optional security feature.

• Switches must have the same password to exchange VTP messages.

Important Note

• VTP works only if:

o Trunk link is active

 o Trunk is correctly configured

3) VTP Modes

• VTP Server

• Controls VLAN configuration for the whole domain.

• Can create, delete, rename VLANs.

• Stores VLAN info in NVRAM (permanent).

• Sends updates to other switches.

• Multiple servers can exist.

• VTP Client

• Cannot change VLANs.

• Receives VLAN info from servers.

• Stores info in RAM (temporary).

• VLAN info is lost after reboot.

• Must be configured manually.

• VTP Transparent

• Does NOT participate in VTP (only forwards messages).

• Manages VLANs locally only.

• Does NOT share VLAN info with others.

• Stores VLANs in NVRAM.

• Required to create extended VLANs (in VTP v1 & v2).

4) VTP Modes Comparison

Feature Server Client Transparent

Responds to VTP Yes Yes Forwards only

Save VLANs after reboot Yes (NVRAM) No (RAM) Yes (local only)

Can modify VLANs Yes No Yes (local only)

Updates other switches Yes Yes No

5) VTP Advertisements Types

• Summary Advertisement

o Contains domain name + revision number

• Advertisement Request

o Sent when a switch needs updated info

• Subset Advertisement

o Contains detailed VLAN information and changes

6) VTP Versions

• VTP Version 1

• Default version

• Supports normal VLANs only

• VTP Version 2

• Supports normal VLANs

• Adds:

o Token Ring support

o Advanced features (like consistency checks)

Note:

• All switches in the same domain must use the same VTP version.

• VTP Version 3 exists but is not required here.

Key Idea

• VTP simplifies VLAN management across many switches.

• Use:

o Server → control VLANs

o Client → receive VLANs

o Transparent → local control only

• Always ensure:

o Same domain

o Same version

o Proper trunk configuration

VTP Concepts and Operation (Continued)

1) Verify Default VTP Status

• Use the command:

o show vtp status

This command shows:

• VTP version (supported & running)

• VTP domain name

• VTP pruning mode

• VTP traps (notifications)

• Device ID

• Last configuration change

 • VTP operating mode (server/client/transparent)

• Maximum VLANs supported

• Number of existing VLANs

• Configuration revision number

• MD5 digest (used for verification/security)

2) VTP Caveats (Important Notes)

• Configuration Revision Number

• Stored in NVRAM (saved even after reboot).

• It is very important because:

o The switch with the highest revision number wins.

o Other switches will update their VLAN database based on it.

• Reset Revision Number to Zero

You can reset it by:

• Changing VTP domain to a fake name, then back to original

OR

• Changing mode to transparent, then back to previous mode

3) VTP Caveat Example (Very Important )

Scenario:

• A new switch (S4) is added to the network.

• It has:

o Same VTP domain name

o Higher revision number (e.g., 35)

o Different VLANs (only VLAN 1, 30, 40)

 o Missing VLANs (10 and 20)

What happens?

• Because S4 has a higher revision number:

o All other switches accept its VLAN database

• Result:

o VLAN 10 and VLAN 20 are deleted from the network

Impact:

• Devices connected to VLAN 10 and 20:

o Lose network connectivity

Key Idea (VERY IMPORTANT for exams)

• Always be careful when adding a new switch to a VTP domain.

• A higher revision number can overwrite the entire network VLAN

configuration.

Best Practice

Before adding a switch:

• Reset its VTP revision number

• Delete VLAN database ([Link] file)

• Or set it to transparent mode first

VTP Configuration

1) VTP Configuration Overview

To configure VTP, follow these steps:

1. Configure the VTP Server

 2. Set VTP Domain Name and Password

3. Configure VTP Clients

4. Create VLANs on the Server

5. Verify that Clients received VLANs

2) Step 1 – Configure the VTP Server

• Command:

o vtp mode server

Important Notes:

• Make sure switches are in default configuration first

(to avoid revision number problems )

• Verify using:

o show vtp status

Default Info:

• Revision number = 0

• Default VLANs = 5 VLANs:

o VLAN 1

o VLANs 1002–1005

3) Step 2 – Configure Domain Name & Password

Set Domain Name

• Command:

o vtp domain domain-name

• Must be same on all switches

Set Password

• Command:
 o vtp password password

• Verify:

o show vtp password

4) Step 3 – Configure VTP Clients

• Command:

o vtp mode client

• Must have:

o Same domain name

o Same password as server

5) Step 4 – Configure VLANs on Server

• Create VLAN:

o vlan vlan-number

• Verify VLANs:

o show vlan brief

• Check VTP status:

o show vtp status

Important Note:

• Every time you add a VLAN →

Configuration Revision Number increases

6) Step 5 – Verify Clients

• On client switches:

Check VLANs:

• show vlan brief

Check VTP status:

• show vtp status

• If configured correctly:

o Clients will automatically receive VLANs from server

Key Idea (VERY IMPORTANT)

• Only the VTP Server creates VLANs

• Clients receive VLANs automatically

• All switches must have:

o Same domain

o Same password

o Working trunk links

Quick Flow (Easy to Remember)

Server → Set Domain → Set Password → Clients → Create VLANs → Verify

Extended VLANs

1) VLAN Ranges on Catalyst Switches

• Switches like 2960 and 3560 support 4000+ VLANs.

• Normal VLAN Range

• VLAN IDs: 1 → 1005

• Stored in: [Link] file (flash memory)

• Learned and shared using VTP

• Extended VLAN Range

• VLAN IDs: 1006 → 4094

• Not stored in [Link]

 • Not supported by VTP (not learned/shared)

2) Creating VLANs

• Command:

o vlan vlan-id

Naming VLAN (Best Practice)

• Command:

o name vlan-name

Create Multiple VLANs

• Example:

o vlan 100,102,105-107

3) Assigning Ports to VLANs

• An access port can belong to:

o Only one VLAN at a time

Exception

• If an IP phone is connected:

o One VLAN for data

o One VLAN for voice

Configure Multiple Ports

• Use:

o interface range (to configure many ports at once)

4) Verifying VLAN Information

Useful commands:

• show vlan
 • show vlan brief

• show vlan summary

• show vlan name vlan-name

• show interfaces

• show interfaces vlan vlan-id

5) Configuring Extended VLANs

Important Notes

• Extended VLANs = 1006 → 4094

• On switches like 2960:

o Must be in VTP Transparent Mode

• By default:

o Extended VLANs are NOT supported in VTP server/client mode

Key Idea

• Normal VLANs:

o Stored in [Link]

o Shared via VTP

• Extended VLANs:

o Not stored in [Link]

o Not shared by VTP

o Need transparent mode

Easy Memory Trick

• 1–1005 → Normal (VTP works)

• 1006–4094 → Extended (VTP does NOT work)

Dynamic Trunking Protocol (DTP)

1) Introduction to DTP

• DTP (Dynamic Trunking Protocol) is used to automatically negotiate trunk

links between switches.

• It is a Cisco proprietary protocol.

• Enabled by default on switches like:

o Catalyst 2960

o Catalyst 3560

Important Note

• If connecting to a device that does NOT support DTP:

o Use:

▪ switchport mode trunk

▪ switchport nonegotiate

• This disables negotiation and forces trunk manually.

2) Trunking Modes

• Access Mode

• Command:

o switchport mode access

• Behavior:

o Always non-trunk

o Used for end devices (PCs, printers)

• Dynamic Auto

• Command:
 o switchport mode dynamic auto

• Behavior:

o Becomes trunk only if the other side requests it

• Passive mode

• Dynamic Desirable

• Command:

o switchport mode dynamic desirable

• Behavior:

o Actively tries to become a trunk

o Works with:

▪ trunk

▪ desirable

▪ auto

• Trunk Mode

• Command:

o switchport mode trunk

• Behavior:

o Always trunk (no negotiation needed)

• Nonegotiate

• Command:

o switchport nonegotiate

• Behavior:

o Stops sending DTP messages

 o Used with manual trunk configuration

3) Verification Command

• Check DTP status:

o show dtp interface

4) Best Practice

• Always configure trunk links manually instead of relying on DTP.

• This improves:

o Security

o Stability

Key Idea

• DTP helps switches decide automatically if a link should be trunk or not.

• But in real networks:

o Manual trunk configuration is safer and better.

Easy Memory Trick

• Auto = wait

• Desirable = ask

• Trunk = force

2.2 Troubleshooting Multi-VLAN Issues

1) Deleting VLANs

Key Points

• If a VLAN is deleted on a VTP Server:

 o It is removed from ALL switches in the VTP domain

• Command:

o no vlan vlan-id

Important Notes

• You cannot delete default VLANs:

o VLAN 1

o VLANs 1002–1005

• When a VLAN is deleted:

o All ports in that VLAN become inactive

o They stay inactive until assigned to another VLAN

2) Switch Port Issues (Inter-VLAN Routing)

Case 1: Legacy Inter-VLAN Routing

• Each router interface connects to a separate VLAN.

• Switch port must be:

o In access mode

o Assigned to the correct VLAN

Scenario

• Port Fa0/4 on switch S1 is:

o In default VLAN (VLAN 1 )

• But it should be:

o VLAN 10

Problem

• Devices in VLAN 10 cannot communicate with router

 Solution

interface fa0/4
switchport mode access
switchport access vlan 10

3) Switch Port Issues (Router-on-a-Stick)

Key Idea

• Router uses one interface with subinterfaces

• Switch port connecting to router must be:

o Trunk port

Scenario (Incorrect)

• Port Fa0/5 on switch S1:

o Still in default VLAN

o Not configured as trunk

Problem

• VLAN traffic cannot reach router

• Inter-VLAN routing fails

Solution

interface fa0/5
switchport mode trunk

Key Troubleshooting Tips

• Check VLAN exists:

o show vlan brief

 • Check port VLAN:

o show interfaces

• Check trunk:

o show interfaces trunk

• Check VTP:

o show vtp status

Key Idea

• Wrong VLAN or wrong port mode = no communication

• Always check:

o VLAN assignment

o Access vs Trunk mode

o VTP impact

Easy Memory Trick

• Access port → one VLAN

• Trunk port → multiple VLANs

Inter-VLAN Configuration Issues (Troubleshooting)

1) Verify Switch Configuration

Useful Commands

• show interfaces interface-id switchport

→ Shows:

o Mode (access / trunk)

o VLAN assignment
 • show running-config
→ Shows full configuration of the switch

Why Important?

• Helps you check:

o Is the port in the correct VLAN?

o Is it access or trunk?

o Is configuration applied correctly?

2) Interface Issues (Common Problem)

Scenario

• Router is connected to the wrong switch port

• Example:

o Router connected to a port that:

▪ Is not configured correctly

▪ Or belongs to wrong VLAN

Problem

• Inter-VLAN routing does not work

• Devices cannot communicate between VLANs

Solution

• Make sure:

o Router is connected to the correct switch port

o That port is configured properly:

▪ Access (legacy routing)

▪ OR trunk (router-on-a-stick)
3) Verify Routing Configuration

Common Problem (Router-on-a-Stick)

Scenario

• Wrong VLAN ID assigned to router subinterface

Example:

interface g0/0.10
encapsulation dot1Q 20 ← WRONG

Problem

• VLAN mismatch → no communication

Solution

• Correct VLAN ID:

interface g0/0.10
encapsulation dot1Q 10 ← CORRECT
ip address [Link] [Link]

Verification Commands (Router)

• show interfaces
→ Check interface status and encapsulation

• show running-config
→ Verify subinterfaces and VLAN IDs

Key Troubleshooting Checklist

When inter-VLAN routing fails, check:

1. VLAN exists → show vlan brief

2. Port VLAN assignment → show interfaces switchport

 3. Trunk configuration → show interfaces trunk

4. Router connection (correct port)

5. Subinterface VLAN IDs (dot1Q)

6. IP addressing

Key Idea

• Most problems come from:

o Wrong VLAN

o Wrong port mode

o Wrong subinterface configuration

Easy Memory Trick

• Switch side → VLAN + mode

• Router side → subinterface + dot1Q

IP Addressing Issues (Inter-VLAN Troubleshooting)

1) Errors with IP Addresses and Subnet Masks

Key Idea

• For inter-VLAN routing to work:

o Router must connect to all VLANs:

▪ Either using multiple physical interfaces

▪ Or subinterfaces (Router-on-a-Stick)

Important Requirements

• Each router interface / subinterface must have:

o An IP address from the correct subnet

 • Each PC must have:

o IP address in the same VLAN subnet

2) Incorrect IP Address (Common Problem)

Scenario 1 (Router)

• Subinterface configured with wrong IP:

interface g0/0.10
ip address [Link] [Link] ← WRONG

Problem

• VLAN 10 devices cannot reach router

Solution

interface g0/0.10
ip address [Link] [Link] ← CORRECT

3) Incorrect End Device IP

Scenario 2 (PC)

• PC in VLAN 10 has:

o IP: [Link]

Problem

• PC cannot communicate with its VLAN or router

Solution

• Assign correct IP:

o 192.168.10.x (same subnet as VLAN 10)

4) Verification Commands

On Router

• show running-config → check IP addresses

• show ip interface → verify interface status and IP

On PC (Windows)

• ipconfig → check IP address and subnet mask

5) Common Mistakes

• Wrong IP address on router subinterface

• Wrong subnet mask

• PC in wrong subnet

• Missing default gateway on PC

Key Troubleshooting Checklist

When IP issues happen, check:

1. Router IP matches VLAN subnet

2. Subinterface configuration is correct

3. PC IP is in correct VLAN subnet

4. Subnet mask is correct

5. Default gateway is correct

Key Idea

• Router = Gateway ‫ لكل‬VLAN

• If IP addressing is wrong → No communication

Easy Memory Trick

• Same VLAN = Same subnet

• Different VLAN = Different subnet

Troubleshooting VTP Issues

Common VTP Problems

1) Incompatible VTP Versions

• Problem:

o Switches use different VTP versions → no communication

• Solution:

o Configure same VTP version on all switches

2) VTP Password Issues

• Problem:

o Password mismatch → switches don’t exchange VTP updates

• Solution:

o Make sure same password on all switches

3) Incorrect VTP Domain Name

• Problem:

o Different domain names → no VTP communication

• Solution:

o Configure same domain name everywhere

4) All Switches in Client Mode

• Problem:

o No switch can create VLANs

 • Solution:

o Set at least one switch as VTP Server

5) Incorrect Configuration Revision Number

• Problem:

o A switch with higher revision number overwrites VLAN database

• Result:

o VLANs may be deleted → network failure

• Solution:

o Reset revision number before adding new switch:

▪ Change domain name

▪ Or set mode to transparent then back

6) VTP and DTP Issues

• Problem:

o Trunk not working → VTP cannot send updates

• Solution:

o Ensure trunk links are active and correct

Troubleshooting DTP (Trunk) Issues

Common Trunk Problems

1) Trunk Mode Mismatch

Example:

• One side = trunk

 • Other side = access
OR

• Both sides = dynamic auto (no one initiates)

Problem:

• Trunk link does not form

Solution:

interface fa0/x
switchport mode trunk

• Or:

o One side → desirable

o Other side → auto

• Recommended:

o Configure manual trunk

2) Allowed VLANs Issue

Problem:

• VLAN not allowed on trunk

→ No traffic passes

Solution:

switchport trunk allowed vlan 10,20,30

3) Native VLAN Mismatch

Problem:

• Different native VLAN on each side

• Switch shows warning messages

Impact:
 • Traffic issues / security risk

Solution:

switchport trunk native vlan 99

• Make sure both sides use same native VLAN

Best Practice

• Always:

o Configure trunk manually

o Match VLANs on both sides

o Verify configuration

Useful Verification Commands

• show vtp status

• show interfaces trunk

• show dtp interface

• show vlan brief

Key Idea

• VTP problems = VLANs not syncing

• DTP problems = trunk not working

• No trunk → No VLAN communication

Easy Memory Trick

• Same domain + password + version = VTP works

• Same mode + VLANs + native = Trunk works

2.3 Layer 3 Switching

1) Introduction to Layer 3 Switching

• Multilayer switches (Layer 3 switches) can:

o Switch (Layer 2)

o Route (Layer 3)

• They use hardware-based processing → very fast performance

Types of Layer 3 Interfaces

• Routed Port

• A physical Layer 3 interface

• Works like a router interface (no VLAN)

• SVI (Switch Virtual Interface)

• A virtual interface for a VLAN

• Used for inter-VLAN routing

Important Notes

• Most Layer 3 switches support:

o Routing protocols (OSPF, etc.)

• Some models need advanced software for full features

• Example:

o Catalyst 2960 supports static routing only

2) Inter-VLAN Routing with SVIs

Old vs New

• Old:
 o Switching = fast

o Routing = slow
→ Networks used mostly Layer 2

• Now:

o Routing is very fast (wire speed)

→ Used in distribution & core layers

Where Layer 3 Switching is Used

• Distribution layer → acts as gateway

• Core layer → high-speed routing

How it Works

• Each VLAN gets an SVI (virtual interface)

• SVI acts as the default gateway for that VLAN

3) What is an SVI?

Definition

• A virtual interface inside the switch used to:

o Route traffic between VLANs

o Provide IP connectivity

o Support routing protocols

4) Advantages of SVI

• Faster than Router-on-a-Stick

• No need for external router

• Not limited to one link

 • Can use EtherChannel for higher bandwidth

Example (Concept)

• VLAN 10 → SVI IP: [Link]

• VLAN 20 → SVI IP: [Link]

→ Switch routes traffic between them directly

Key Idea

• Layer 3 switches = Switch + Router in one device

• SVI = Gateway for each VLAN

• Faster and more efficient than old methods

Easy Memory Trick

• SVI = Virtual Router inside Switch

Layer 3 Switching – Routed Ports & Troubleshooting

1) Inter-VLAN Routing with Routed Ports

What is a Routed Port?

• A routed port is a physical switch port that works like a router interface.

Key Features

• Not assigned to any VLAN

• Does NOT support subinterfaces

• Works purely at Layer 3 (IP routing)

Where It is Used
 • Mainly between:

o Distribution layer switches

o Core layer switches

Configuration Command

interface g0/1
no switchport
ip address [Link] [Link]

Important Note

• Routed ports are NOT supported on Catalyst 2960

2) Layer 3 Switch Configuration Troubleshooting

What to Check

1. VLANs

• Make sure VLANs exist and are correct:

o show vlan brief

2. SVIs (Switch Virtual Interfaces)

Check:

• Correct IP address

• Correct subnet mask

• Correct VLAN ID

Command:

• show ip interface brief

3. Routing

• Ensure routing is enabled:

o Static routing OR dynamic routing (OSPF, etc.)

Command:

• show ip route

4. Hosts (PCs)

Verify:

• Correct IP address

• Correct subnet mask

• Correct default gateway

3) Example: Troubleshooting Process (Step-by-Step)

Scenario: New VLAN 500 is added

Step 1: Create VLAN

• VLAN 500 must exist on:

o Access switch

o Distribution switch

Step 2: Assign Ports + Trunk

• Add ports to VLAN 500

• Ensure trunk links are working between switches

Step 3: Configure SVI

 • Create SVI for VLAN 500:

o Assign IP address

o Ensure VLAN number matches

Step 4: Test Connectivity

• Ping between hosts

• Check routing

4) Troubleshooting Checklist

If Problem Happens → Check:

✔ VLAN exists
✔ Ports are in correct VLAN
✔ Trunk is working
✔ SVI is configured correctly
✔ IP address + subnet mask correct
✔ Routing is enabled
✔ Default gateway on PCs is correct

Key Idea

• Routed port = router-like physical interface

• SVI = virtual gateway for VLAN

• Most issues come from:

o VLAN mismatch

o Wrong SVI IP

o Broken trunk

Easy Memory Trick

• Routed Port → Physical Layer 3

• SVI → Virtual Layer 3 for VLANs