Course contents

Chapter 4: VLANs and TrunksLesson 5 of 18

DTP: Dynamic Trunking Protocol

Access, trunk, dynamic auto and desirable: what pairs of modes produce, verification, and why DTP is turned off.

Intermediate · 9 min read

Technical definition

DTP (Dynamic Trunking Protocol) is a Cisco proprietary protocol that lets two directly connected switch ports negotiate whether to form a trunk. The result depends on each port's administrative mode.

Why DTP exists

When two switches are cabled together, someone has to decide whether the link is a trunk. DTP lets the two ports work that out themselves. Each port has an administrative mode, they exchange DTP frames, and the pair either becomes a trunk or stays an access link. DTP is Cisco proprietary, so it only works between Cisco devices, and it only runs on directly connected ports.

The five modes

Switchport modes and what each one sends
Switchport modes and what each one sendsMode; Command; Behaviour. access: switchport mode access Always an access port. Sends no DTP frames and tells the other side it is not trunking. trunk: switchport mode trunk Always a trunk, and still sends DTP frames so the other end can join. dynamic desirable: switchport mode dynamic desirable Actively asks the other end to form a trunk. dynamic auto: switchport mode dynamic auto Passive: becomes a trunk only if the other end asks. trunk, no negotiation: switchport nonegotiate Stops DTP frames; used on a static trunk or access port.ModeCommandBehaviouraccessswitchport mode accessAlways an access port. Sends no DTPframes and tells the other side it isnot trunking.trunkswitchport mode trunkAlways a trunk, and still sends DTPframes so the other end can join.dynamic desirableswitchport mode dynamic desirableActively asks the other end to form atrunk.dynamic autoswitchport mode dynamic autoPassive: becomes a trunk only if theother end asks.trunk, no negotiationswitchport nonegotiateStops DTP frames; used on a statictrunk or access port.

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the mode, the command that sets it, and what the port does.

What two ports become

Result of each pair of modes
Result of each pair of modesPort A; Port B; Result. trunk: trunk Trunk trunk: dynamic desirable Trunk trunk: dynamic auto Trunk dynamic desirable: dynamic desirable Trunk dynamic desirable: dynamic auto Trunk dynamic auto: dynamic auto Access: neither side asks access: any dynamic mode Access access: trunk Mismatch: no working link between themPort APort BResulttrunktrunkTrunktrunkdynamic desirableTrunktrunkdynamic autoTrunkdynamic desirabledynamic desirableTrunkdynamic desirabledynamic autoTrunkdynamic autodynamic autoAccess: neither side asksaccessany dynamic modeAccessaccesstrunkMismatch: no working link betweenthem

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Memory aid: trunk and desirable always start a trunk, auto only agrees, and access never trunks.

A trunk on one end and an access port on the other does not negotiate down. Frames are tagged on one side and not the other, so traffic is lost. DTP also needs the switches to agree on the VTP domain name if both have one set; with different domains negotiation does not complete.

Configuring and verifying

Commands are based on Cisco IOS documentation and have not been run on a lab device here.

interface GigabitEthernet0/1 switchport mode trunk switchport nonegotiate ! interface range FastEthernet0/1 - 24 switchport mode access switchport nonegotiate

The safe pattern: set every port explicitly, and stop DTP on all of them. On some models you first need switchport trunk encapsulation dot1q before switchport mode trunk.

Example output · based on Cisco documentation; exact format varies by platform and software version
SW1#show interfaces GigabitEthernet0/1 switchport
Name: Gi0/1
Switchport: Enabled
Administrative Mode: dynamic desirable
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Example output. Administrative Mode is what was configured, Operational Mode is what the port is actually doing, and Negotiation of Trunking: On means DTP is running. Compare the two modes when a link is not behaving as expected.

show dtp interface gi0/1 shows the DTP state and the frames sent and received, and show interfaces trunk lists the ports that are actually trunking.

DTP and security

A port left in a dynamic mode will answer DTP from anything that speaks it. An attacker who connects a laptop or a rogue switch can send DTP frames, make the port a trunk, and then send and receive traffic for every VLAN on it. That is a switch spoofing attack, a form of VLAN hopping. The defence is simple: set every access port to switchport mode access, set real trunks to switchport mode trunk with switchport nonegotiate, and shut down unused ports in an unused VLAN.

DTP in short

  • DTP is Cisco proprietary and negotiates a trunk between two directly connected ports.
  • Trunk and desirable start a trunk; auto only agrees; access never trunks.
  • Two dynamic auto ports stay access ports.
  • Best practice: static modes plus switchport nonegotiate.

Test yourself

Predict · scenario 1

Two switches both have their ports set to dynamic auto. What is the result?

Predict · scenario 2

Which pair of modes forms a trunk?

Predict · scenario 3

What does switchport nonegotiate do?

Predict · scenario 4

Which attack is made possible by leaving a port in a dynamic mode?

Predict · scenario 5

Which show command compares the configured and actual trunking state of one port?

FAQ

What is the default DTP mode?
On most current Catalyst switches the default is dynamic auto, which waits to be asked. Some older platforms defaulted to dynamic desirable. Check show interfaces switchport on your model.
Why do two dynamic auto ports not form a trunk?
Auto only answers; it never starts the negotiation. Two passive ports wait for each other forever and stay access ports.
Should I leave DTP on?
No. Set trunk ports to trunk and edge ports to access, and add switchport nonegotiate on trunks. Leaving ports dynamic is a security risk and makes the link depend on what the other side does.