VLAN Trunking Protocol (VTP) enables VLAN configurations made on one switch to automatically propagate across all switches within the same VTP domain, simplifying administration in large-scale network environments. This content covers VTP modes, advertisements, domains, configuration revision numbers, and versioning at the level required for CCNA exam preparation.
VLAN Trunking Protocol (VTP)
VLAN trunking protocol, or VTP, is a way that we can configure VLANs on a single switch and then have those VLANs propagate to all other switches within a domain. It's a quick and easy way to administer a whole enterprise network. This could actually be a whole module — we could get really in depth into VTP and the configuration of VTP. In the past that's the way the CCNA was, it was much more focused on it, but they've removed most of the questions around VTP, so we're going to learn just the basics, enough for you to answer CCNA.
The first thing that I want to stress is that VLAN trunking protocol is not trunking. I don't really like the name VLAN trunking protocol because of this trunking that's within the name; it misleads us a little bit. VLAN trunking is when we are passing multiple VLANs across a single connection. From a VLAN trunking protocol point of view, what we're doing is transferring VLANs from switch to switch.
With the diagram that we have right here we have four different switches. Let's say in our network we wanted 10 different VLANs. What I would have to do is configure essentially 40 VLANs: I'd have to go to this switch and configure those 10 VLANs, go to this switch and configure these 10 VLANs, go to this switch and configure those. Quite honestly, with the way I set up and configure devices this really wouldn't be a big deal, because I'd just type it all up and then get onto each one of these switches and paste it onto each of them. Four switches would be nothing for this. But let's say I'm dealing with hundreds of switches — now suddenly this becomes a big deal, where I have to get onto 100 different switches just to program these 10 VLANs, and that can be problematic.
VLAN trunking protocol will allow a single device to start communicating with the other devices. When we configure a VLAN — let's say we configure VLAN 20 onto this device — it gets propagated and sent to all of these other devices, and now all of these other devices have VLAN 20 on them as well. It does this through VTP advertisements. When we set that VLAN up on this switch, it sends out a VTP advertisement that gets sent to this switch so it can get set up, and then gets sent to this switch and it sets it up on that switch.
Ultimately this is going to be a simplification of VTP, but this is one of the advertisements that we could possibly see going between two switches when it's communicating this VTP information. Some interesting fields here are:
These VTP advertisements get sent back and forth between these switches so that the information gets propagated to all of these devices.
We can actually set each one of these switches to one of three modes: we could set it as a server, we could set it as a client, or we could set it to be transparent. No matter which mode you have set up on a switch, whether it's server, client or transparent, they're all going to transmit and receive advertisements.
If it's labeled as a client it does one additional step: it takes that advertisement and actually processes it, which means that a client can change its VLAN database to update it. A transparent one will only transmit and receive these advertisements without updating its VLAN database. A server is the one you can actually do the modification on, so if I want to make a change across my network I would have to get onto a server to make that change.
On this network right here, this main core switch would probably be the server, and then these other switches on here would probably be clients. However, for the purpose of this, let's just say that we want to make this one right here transparent — maybe there's something special about this one where we need to do a little different configuration on it. What will happen is we will make the change on the server, the server will then send an advertisement out to these devices, and this client will make the change. Let's say we're adding VLAN 30 to this. This client will add VLAN 30, it'll get sent out to this transparent one, that transparent one will forward it on to this client, and then this client will add 30. But 30 will not get installed on this switch right here, because it's set to transparent.
One of the key things to this is that these switches need to be on the same VTP domain. What I'm going to do is go onto these different switches, and maybe I configure these two switches as admin. At that point in time this switch right here would then send advertisements out, but this other switch, since it's on the same domain, will actually be listening and will update its own VLAN database.
If these two switches are on a different domain — maybe they're on the sales domain — then these would act separately and they wouldn't get the update. If I'm updating VLAN 40 on these devices, these two would not automatically update, because they're part of a different domain.
The configuration revision numbers increment up as we make changes, and it tells all of the other devices what version the database is on. Let's say all of these switches are on the same domain, so maybe we just have one single domain called admin — it's the same VTP domain and so it's all admin. Let's say this is the server right here, these are all clients right here, and we're on revision number 101. It starts at zero and counts its way up. Let's say we're on revision 101 and we add VLAN 50 to this. Now it goes to 102. It's going to send out advertisements, and within that advertisement it will say who this is from, so this server right here, and it will also have a revision number of 102. These will now see that they're on revision number 101 and realize that they need to be updated.
Now we start seeing where the components of the advertisement are important. We've got the management domain, and this management domain says should I be listening to this advertisement or not. We also have the configuration revision number, so it can compare against the revision number it has to know whether it needs to be updated or not. It has the updater identity, who made the update, because you can actually have multiple servers within your network. And the MD5 digest is just to check to see if anything has changed or if there's any corrupt data within this advertisement.
Let's see what happens if we add a new switch here. Let's say it's a fresh install, and so the VTP domain is null — that means there's nothing in it, it's not been programmed for anything. We add that to this switch right here, and this switch is set up as a client, and it's now sending some VTP advertisements out. Let's say once again it's for the admin domain. It sends that out, this switch sees that there is a VTP advertisement and receives it, and what it will do is actually do an update of its domains. So it'll add admin as the domain here and become a part of this VTP domain. You don't need to do anything on the switch, you just add it and then it will automatically update.
This introduces a couple of problems, because maybe we don't want this switch necessarily to update with it. Or there's an even more significant problem. Let's say this is a switch that we took out of circulation, so it already was part of the admin VTP domain. We took it out, we were doing some testing on it, we were adding some VLANs and testing it out, and now the revision number is at 150 where everything else is at 102. Now this causes a problem, because when we reconnect it to the network it will see that this has a revision number that's much higher, and it will start updating — if it's a server, start updating all the rest of the database. It can cause a lot of problems on your network, so you need to make sure that this switch right here is completely wiped before you put it on the network. This is one of the reasons why you probably don't want to be using VTP on your domain, and there are better solutions to be able to manage your whole domain and the VLANs on your domain.
There are different versions of VTP. I don't have them all listed out here, but here are a few of the version differences between 1, 2 and 3. First of all, the VLANs supported: version 1 and 2 is just 1 through 1005, versus version 3, which has the extended VLANs supported as well. Version 1 doesn't support token ring. Version 1 doesn't have error checking. Versions 1 and 2 have clear text with their password — there's an authentication piece that can happen, and the passwords are sent in clear text, which is not something that we want — so version 3 has it as being encrypted.
It's unfortunate to a certain degree that we can't go more in depth into it, because I really do like teaching VTP; it really is a cool protocol. But ultimately it's not something that I've used in production out there, even with my larger enterprise networks, and so it's not something that's really recommended.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →