VMware ESXi and vSphere Cluster Management

Configure VTP on Cisco Switches

Learn how to configure Cisco VTP servers and clients, establish trunk requirements, propagate VLAN 30, verify synchronization, and prevent VTP revision problems.

VLAN Trunking Protocol (VTP) is a Cisco Layer 2 protocol that distributes VLAN database information between switches. Instead of creating the same VLAN manually on every switch, an authorized VTP server can advertise VLAN additions, changes, and removals to participating switches in the same VTP domain.

VTP is useful in controlled environments, but an incorrect configuration can affect many switches. Always verify the VTP domain, password, version, mode, trunk state, and configuration revision before connecting a switch to an existing VTP domain.

Prerequisites: You should understand VLAN IDs, Cisco IOS command modes, switch interfaces, 802.1Q trunking, and basic show commands.

How VTP Works

A VTP domain is a logical group of switches that share a domain name and participate in the same VLAN database synchronization scope. A VTP advertisement is a protocol message carrying VLAN database information between switches.

When a VLAN is created, modified, or removed on a VTP server, the server can advertise the updated VLAN database. A participating switch evaluates the advertisement and uses the VTP configuration revision to determine whether the received database is newer than its local database.

VTP advertisements travel over operational Layer 2 trunk links.
VTP distributes VLAN definitions and related VLAN database information.
VTP does not distribute switch-port VLAN assignments.
VTP does not distribute trunk configuration, spanning-tree configuration, or every other switch setting.
VTP does not replace the need to configure access ports, trunk ports, IP addresses, or routing.

A VLAN is a logical Layer 2 network segment identified by a VLAN ID. The VLAN database is the switch-maintained collection of VLAN definitions and related information.

VTP Modes

Mode	Receives VTP Updates	Advertises VLAN Changes	Can Create or Modify VLANs	VLAN Database Behavior	Typical Use
Server	Yes	Yes	Yes	Maintains and advertises VLAN database changes	Central VLAN administration
Client	Yes	Normally does not originate local VLAN changes	Normally no	Synchronizes from an accepted server advertisement	Switches that consume centralized VLAN information
Transparent	Does not synchronize its database	Typically forwards advertisements without applying them	Yes, locally	Maintains an independent local VLAN database	Local VLAN administration without synchronization
Off, where supported	No	No	Yes, locally	Does not participate in VTP	Networks that do not want VTP participation

Server Mode

In server mode, a switch can create, modify, and delete VLANs and advertise VLAN database updates. Cisco switches commonly default to server mode, although the default can vary by platform and software release. Verify the actual mode rather than relying on a presumed default.

Client Mode

In client mode, a switch receives accepted VLAN database updates from VTP advertisements. It normally does not create or alter VLANs locally. Client mode is appropriate for switches whose VLAN definitions should be controlled by a VTP server.

Transparent and Off Modes

In transparent mode, a switch maintains its own VLAN database and does not synchronize that database with VTP. Depending on the VTP version and platform, it can forward VTP advertisements through its trunk links. Off mode, where supported, disables VTP participation and forwarding. Use transparent or off mode when centralized VLAN synchronization is not desired.

Requirements for VTP Synchronization

Requirement	What Must Match or Exist	Effect of Mismatch
VTP domain name	Exactly the same domain name on participating switches	Advertisements are not accepted for the intended domain
VTP version	Compatible and consistently configured versions	Advertisements may not be understood or accepted
VTP password	The same password when authentication is configured	Authenticated advertisements fail validation
VTP mode	An appropriate role, such as server or client	Transparent or off switches do not synchronize their databases
Operational trunk connectivity	Layer 2 trunk links between participating switches	VTP advertisements cannot traverse the link
Configuration revision	The received database must have a newer accepted revision	An update may be ignored, or a higher-revision database may replace local VLAN information

VTP domain names and passwords are case-sensitive. A spelling difference such as CCNA-LAB versus ccna-lab prevents the expected match.

Three-Switch Configuration Scenario

The example uses three Cisco switches:

SW1: VTP server
SW2: VTP client
SW3: VTP client
Links: SW1 connects to SW2 and SW3 through operational trunk links
Domain: CCNA-LAB
Password: VTPpass
Version: VTP version 2 for this lab

Interface names vary by platform. The example assumes GigabitEthernet0/1 is an inter-switch interface. Configure the corresponding interface on both ends of each link.

Step 1: Configure and Verify the Trunks

enable
configure terminal
interface gigabitEthernet0/1
 switchport mode trunk
 no shutdown
end

Repeat the configuration on the appropriate inter-switch interfaces. Some platforms require a trunk encapsulation command, while others support only 802.1Q and do not provide that command. Follow the syntax supported by the switch.

Before configuring VTP, verify that the links are actually trunking:

show interfaces trunk

Step 2: Configure SW1 as the VTP Server

enable
configure terminal
vtp domain CCNA-LAB
vtp password VTPpass
vtp version 2
vtp mode server
end

Server mode may already be the default on many Cisco switches, but setting it explicitly documents the intended role.

Step 3: Configure SW2 and SW3 as VTP Clients

Run the following configuration on both SW2 and SW3:

enable
configure terminal
vtp domain CCNA-LAB
vtp password VTPpass
vtp version 2
vtp mode client
end

All three switches must use the same domain, password, and compatible version. Configure the password consistently; do not configure authentication on only some participating switches.

Step 4: Create VLAN 30 on SW1

Create the VLAN only on the server:

enable
configure terminal
vlan 30
 name USERS
end

If synchronization requirements are satisfied, SW1 advertises the updated VLAN database over its trunk links. SW2 and SW3 accept the newer database and learn VLAN 30 automatically.

VTP creates the VLAN definition, but it does not assign access ports to VLAN 30. Port assignment remains a separate configuration task.

Verification Commands

Command	Purpose	Important Output Fields
`show vtp status`	Displays VTP operating information	VTP version, operating mode, domain name, configuration revision, number of existing VLANs, and authentication status
`show vlan brief`	Lists local VLANs and port membership	VLAN 30, VLAN name, status, and assigned ports
`show interfaces trunk`	Verifies trunk operation	Trunking state, encapsulation, native VLAN, and allowed or active VLANs
`show vtp counters`	Inspects VTP message activity where available	Sent and received advertisement counters and possible error information

Expected Verification

On SW1, show vtp status should identify the CCNA-LAB domain, server mode, the selected version, and a revision that increased after VLAN 30 was created. On SW2 and SW3, the output should show the same domain and version, client mode, and a synchronized VLAN count that includes VLAN 30.

Run the following on all three switches:

show vtp status
show vlan brief
show interfaces trunk
show vtp counters

Use show vlan brief to confirm that VLAN 30 and its name appear on SW1, SW2, and SW3. Use show interfaces trunk to confirm that the links between SW1 and its clients are operational trunks.

Configuration Revision Safety

The VTP configuration revision is a counter used to compare VLAN databases. A switch with a higher revision can cause its VLAN information to overwrite the VLAN information in a VTP domain when it joins in a participating mode. The database might be outdated even though its revision is numerically higher.

Use an approved, platform-supported procedure to sanitize the switch before joining it to production. Depending on the platform and operational policy, this can include placing the switch in transparent mode, changing its VTP domain, or clearing the VLAN database when appropriate. Clearing a VLAN database can affect the switch and should be performed only with authorization and a suitable backup or recovery plan.

If centralized synchronization is unnecessary, configure the network consistently for VTP transparent or off mode where supported. This reduces the risk of an unintended server or stale database affecting other switches.

Troubleshooting VTP Synchronization

VLAN 30 Exists on the Server but Not on a Client

Confirm the physical inter-switch connection is up.
Run show interfaces trunk on both ends and confirm the link is operating as a trunk.
Run show vtp status on every switch.
Compare the domain names exactly, including capitalization.
Compare VTP versions.
Confirm that passwords match, or remove authentication consistently if it is not required.
Confirm that the receiving switch is in client or server mode rather than transparent or off mode.
Use show vtp counters, where available, to check whether advertisements are being received.
Compare configuration revisions and confirm that the server's update is newer than the client's local database.

Correct the mismatch or restore trunk operation, then verify the VLAN database again. A trunk can be physically up but still require inspection of its mode, allowed VLAN settings, and other platform-specific restrictions.

An Attached Switch Changes VLANs Unexpectedly

Immediately inspect the newly connected switch and affected switches with show vtp status. Check the mode, domain, revision, VLAN count, and authentication information. Isolate the device if necessary, follow the organization's recovery procedure, restore the intended VLAN database, and sanitize the switch's VTP state before reconnecting it.

The Domain Matches but Synchronization Still Fails

Check for a VTP version mismatch.
Check password spelling and capitalization.
Verify that the trunk is carrying the expected traffic and has not been restricted by interface settings.
Confirm that the receiving switch is not in transparent or off mode.
Compare complete show vtp status output and VTP counters across the topology.

Exam-Relevant Notes

VTP distributes VLAN database information, not access-port assignments or all switch configuration.
VTP advertisements use Layer 2 trunk links.
Server mode can create and advertise VLAN changes.
Client mode receives VLAN updates and normally cannot create local VLANs.
Transparent mode keeps a local VLAN database and typically forwards advertisements without synchronizing.
Matching domain names, compatible versions, matching passwords, operational trunks, and suitable modes are required for synchronization.
A higher configuration revision can be dangerous when a reused switch joins an existing domain.

Summary

To configure VTP, establish working trunk links, choose a VTP domain, use compatible versions and matching authentication, assign SW1 the server role, assign SW2 and SW3 the client role, and create VLANs on the server. Verify the result with show vtp status, show vlan brief, show interfaces trunk, and show vtp counters where supported. Treat configuration revision numbers as a change-control and safety concern whenever a switch is reused or connected to a production domain.

For the complete procedure, return to Configure VTP.