VMware ESXi and vSphere Cluster Management

VLAN Trunking Protocol (VTP) Overview

Learn how Cisco VTP distributes VLAN database changes across switches, how VTP modes and revision numbers work, and why VTP is different from 802.1Q trunking.

VLAN Trunking Protocol (VTP) is a Cisco-proprietary Layer 2 control-plane protocol. It shares VLAN database information among participating Cisco switches so that VLAN additions, removals, and name changes can be distributed through a switched network.

VTP does not carry end-user traffic and does not create trunk links. A working Layer 2 trunk provides the path for VTP control messages, while IEEE 802.1Q handles VLAN tagging for Ethernet frames.

What VTP Does

A switch maintains a VLAN database: a collection of VLAN identifiers, names, and related VLAN definitions. VTP allows participating switches to exchange this information.

  • A VLAN can be created on a VTP server and advertised to other switches.
  • A VLAN name change can be propagated through the VTP domain.
  • A VLAN deletion can also be propagated, which makes careless changes potentially disruptive.
  • VTP distributes VLAN database information, not host traffic, IP addresses, access-port assignments, routing configuration, or spanning-tree policy.

The Administration Problem VTP Addresses

Without VTP, an administrator may need to create a new VLAN manually on every switch that must recognize it. In a network with 100 switches, adding a departmental VLAN could require repeated configuration work on many access and distribution switches.

With VTP, an administrator can originate the VLAN change on an appropriate server-mode switch. Advertisements can then carry the updated VLAN information through the VTP domain. This reduces repetitive administration and can make large Cisco switching environments easier to maintain.

The same centralization creates risk. An accidental VLAN deletion or an unwanted database update can spread to many switches. VTP should therefore be used with documented ownership, change control, backups, and validation.

VTP Domains

A VTP domain is a logical group of interconnected switches configured to participate under the same domain identity. Switches in the domain are intended to converge on compatible VLAN database information.

VTP advertisements must cross a Layer 2 path. In practice, this means the switches need an operational trunk connection, or a sequence of Layer 2 trunks, between them. A routed connection does not forward VTP advertisements as a Layer 2 trunk would.

Participation Requirements

Requirement — Why it matters — Verification method

Matching domain name — Identifies which switches belong to the same VTP domain — Check VTP status on each switch.

Compatible VTP version — Determines which advertisement features and database capabilities can be used — Check the configured and operating VTP version.

Matching authentication password, when configured — Prevents unauthenticated or mismatched advertisements from being accepted — Compare the documented password policy and VTP status.

Layer 2 trunk path — Provides the transport path for VTP control messages — Use trunk and interface verification commands.

Compatible operating mode — Determines whether a switch originates, applies, or forwards updates — Check whether each switch is server, client, transparent, or off.

How VTP Propagates a VLAN Change

Consider three switches connected in a line:

SW1 ===== 802.1Q trunk ===== SW2 ===== 802.1Q trunk ===== SW3
VTP server                      VTP client                  VTP client

Assume all three switches use the same domain, a compatible version, and the required password. An administrator creates VLAN 20, named ENGINEERING, on SW1.

  1. SW1 updates its VLAN database and increases its configuration revision number.
  2. SW1 sends VTP advertisements over the trunk toward SW2.
  3. SW2 accepts the update if the domain, authentication, version, and revision checks succeed. It updates its VLAN information.
  4. SW2 forwards the relevant VTP information toward SW3.
  5. SW3 accepts the newer information and adds VLAN 20 to its VLAN database.
  6. After convergence, all three switches should show VLAN 20, subject to platform behavior and the configured VTP modes.

VTP advertisements are control messages. At a conceptual level, a summary advertisement identifies the domain and revision information, while subset advertisements carry VLAN database details. A receiving switch uses these messages to decide whether it needs newer VLAN information.

VLAN removal follows the same general propagation model. If VLAN 20 is deleted from the authoritative VTP server, the deletion may be advertised to participating switches. Ports and hosts that depend on that VLAN can then lose connectivity across the domain.

VTP Modes Compared

Mode — Can create or modify VLANs — Learns and applies VTP VLAN updates — Forwards VTP advertisements — Typical use

Server — Yes — Yes — Yes — Centralized VLAN administration in a controlled VTP design.

Client — Normally no local administration of the normal VTP VLAN database — Yes — Yes — Switches that learn VLAN information from the domain.

Transparent — Yes, locally — No, local VLANs are maintained independently — Normally yes through trunk links — Local VLAN control while allowing VTP advertisements to pass through.

Off — Local VLAN management is used — No — No — VTP version 3 designs that intentionally do not participate in VTP advertisement forwarding or synchronization.

Server Mode

A VTP server can create, modify, and delete VLANs in the VTP database. It advertises resulting changes to eligible members of the domain. Server mode is powerful because one change can affect many switches.

Client Mode

A VTP client learns eligible VLAN database updates from advertisements and applies them. It is not normally used to administer the regular VLAN database locally. Client mode is useful when VLAN administration is intentionally centralized, but it increases dependence on the VTP server design.

Transparent Mode

A transparent switch maintains VLAN changes locally rather than synchronizing its own VLAN database with the domain. It normally forwards VTP advertisements through trunk links, allowing other switches farther along the Layer 2 path to receive them. Local VLAN behavior should be verified for the platform and VTP version in use.

VTP Off

VTP version 3 can provide an off mode. An off-mode switch does not participate in VTP advertisement forwarding or synchronization. It can still be managed with locally configured VLAN information according to the platform's behavior.

The mode determines whether a switch originates updates, applies received updates, forwards advertisements, or keeps VLAN administration local.

VTP Versions and Compatibility

VTP versions 1, 2, and 3 are protocol generations with different capabilities and interoperability considerations. A VTP design should choose and document a consistent version across the intended domain.

  • VTP version 1: The original commonly encountered generation, with more limited feature behavior.
  • VTP version 2: Adds protocol improvements and is widely seen in IOS-style learning examples.
  • VTP version 3: Adds stronger administrative controls and broader database support, including support for extended VLAN handling in suitable platforms and releases.

Not every Cisco switch, platform, or software release supports every VTP version or feature identically. Always check the platform documentation before selecting a version or relying on a particular command.

Configuration Revision Numbers

The configuration revision number is a sequence value used by VTP to identify the relative age of VLAN database information. A switch generally considers an advertisement with a higher revision number to contain newer information.

If a higher-revision advertisement is accepted, its VLAN information can overwrite the existing VLAN information on participating switches. This is why a previously used spare switch can be dangerous: it may contain an old VLAN database with a revision number higher than the production domain's current value.

Safe Switch Onboarding

  1. Keep the reused switch isolated from production trunks.
  2. Inspect its VTP domain, mode, version, password state, and configuration revision number.
  3. Reset or clear stale VLAN and VTP state according to the switch platform's documented procedure.
  4. Configure the intended domain, version, mode, and authentication policy while the switch remains isolated.
  5. Validate the VLAN database and revision state.
  6. Connect the production trunk only after the switch has passed the change-control checks.

VTP Is Not VLAN Trunking

The name can cause confusion, but VTP does not form a trunk and does not encapsulate VLAN-tagged user frames.

Feature — VTP — 802.1Q trunking — Operational purpose

Protocol role — Cisco Layer 2 control-plane protocol — IEEE Ethernet VLAN-tagging standard — Distinguishes database control from data forwarding.

What it carries — VLAN database advertisements — Ethernet frames for multiple VLANs, with VLAN tags as appropriate — Communicates VLAN information versus user traffic.

Does it create a trunk? — No — Trunk configuration makes a Layer 2 link carry multiple VLANs — A trunk must be configured and operational independently.

Relationship — VTP messages use an eligible Layer 2 trunk path — 802.1Q provides the tagging mechanism on the trunk — The trunk is the transport path for VTP control messages.

Legacy context — VTP is distinct from trunk encapsulation — ISL was a legacy Cisco trunk encapsulation method — Modern platforms commonly use 802.1Q, but command availability varies.

For example, enabling VTP does not make an interface carry VLANs 10, 20, and 30. The interface must separately be configured as an operational trunk, and its allowed-VLAN policy must include the required VLANs.

Example Cisco IOS-Style Configurations

The following examples use lab-safe values. Syntax and command availability can differ by platform and software release.

VTP Server

configure terminal
vtp domain CAMPUS
vtp version 2
vtp mode server
vtp password ExampleSecret
end

VTP Client

configure terminal
vtp domain CAMPUS
vtp version 2
vtp mode client
vtp password ExampleSecret
end

VTP Transparent Switch

configure terminal
vtp mode transparent
vlan 20
name ENGINEERING
end

In transparent mode, VLAN 20 is configured locally. Confirm the exact behavior for the target platform and VTP version.

Creating a VLAN on the Server

configure terminal
vlan 20
name ENGINEERING
end

Configuring a Trunk Separately

configure terminal
interface gigabitEthernet1/0/1
switchport mode trunk
switchport trunk allowed vlan 10,20,30
end

Do not assume that a trunk-encapsulation command is available on every current Cisco platform. Many modern platforms use 802.1Q only.

Verification Commands

show vtp status
show vlan brief
show interfaces trunk
  • show vtp status helps check the domain, mode, version, revision number, and related VTP state.
  • show vlan brief confirms whether VLANs such as VLAN 20 exist locally.
  • show interfaces trunk confirms trunk operation and helps inspect allowed VLANs.

Scope and Limitations

VTP is Cisco-specific and is generally relevant only to Cisco switching environments that support it. It manages VLAN database information, not the complete configuration required for end-to-end connectivity.

  • It does not automatically assign access ports to the correct VLAN.
  • It does not automatically configure trunk allowed-VLAN lists.
  • It does not configure spanning-tree policy.
  • It does not provide inter-VLAN routing.
  • It does not replace gateway, SVI, router-on-a-stick, or other Layer 3 configuration.

A VLAN must be usable along the physical and logical forwarding path. Access ports must have the correct assignments, trunks must be operational and permit the VLAN, spanning tree must allow forwarding, and Layer 3 devices must be configured separately when communication between VLANs is required.

Operational Design and Safety

Some administrators choose server/client operation when centralized VLAN administration is appropriate and the domain is carefully controlled. Others choose transparent or version 3 off operation to keep VLAN management local and reduce the blast radius of unexpected advertisements.

Risk — Potential impact — Preventive control

Accidental VLAN deletion — The VLAN may disappear across participating switches and disrupt dependent ports — Use change approval, backups, and post-change validation.

Unexpected high revision number — A reused switch may replace current VLAN definitions — Isolate, inspect, reset stale state, and stage the switch before connecting it.

Domain or password mismatch — Updates may not be accepted, leaving inconsistent databases — Document and verify domain and authentication settings.

Wrong operating mode — A switch may apply, ignore, or forward updates differently than intended — Document the design and verify VTP status.

Assuming VTP creates a trunk — VLAN data and VTP messages may not cross the link — Configure and verify an 802.1Q trunk independently.

Incomplete forwarding configuration — A VLAN can exist in the database while hosts still cannot communicate — Check access ports, allowed VLANs, spanning tree, and Layer 3 gateways.

Document the intended VTP domain, version, mode, password policy, authoritative switch, revision-handling procedure, and approval process. After any change, validate both the VLAN database and trunk status.

Troubleshooting VTP

A VLAN Does Not Appear on Another Switch

  • Confirm an active Layer 2 trunk path exists between the switches.
  • Compare domain names, VTP versions, passwords, and operating modes.
  • Verify that the receiving switch is configured to apply VTP updates rather than operate independently.
  • Check VTP status and VLAN listings on each switch.
  • After the VLAN exists, check whether the trunk's allowed-VLAN policy permits that VLAN for traffic forwarding.

Switches Have Different VLAN Databases

  • Check whether one or more switches use transparent or off mode intentionally.
  • Look for domain-name mismatch, authentication mismatch, or version incompatibility.
  • Confirm that the connection is Layer 2 rather than routed.
  • Determine whether the design intentionally uses locally managed VLANs.

VLANs Disappeared After Connecting a Switch

  • Immediately inspect VTP mode, domain, version, and configuration revision values.
  • Determine whether the newly attached switch introduced a higher-revision database.
  • Restore the intended VLAN configuration using approved procedures.
  • Stage and reset reused switches before connecting them to production in the future.

VTP Does Not Make an Interface Carry Multiple VLANs

  • Remember that VTP does not create a trunk.
  • Verify that the interface is configured and operational as an 802.1Q trunk.
  • Check the allowed-VLAN list and physical link status.

The VLAN Exists but Hosts Cannot Communicate

  • Verify endpoint access-port VLAN assignments.
  • Verify trunk operation and allowed VLAN lists.
  • Check spanning-tree forwarding state and port-security or shutdown conditions.
  • For communication between different VLANs, verify the Layer 3 gateway and routing configuration separately.

Key Takeaways

  • VTP is a Cisco Layer 2 control-plane protocol for exchanging VLAN database information.
  • A VTP domain consists of participating switches with compatible settings and Layer 2 connectivity.
  • Server, client, transparent, and version 3 off modes control how switches originate, apply, forward, or ignore VTP updates.
  • Configuration revision numbers help switches select newer databases, but an unexpectedly high value can cause serious disruption.
  • VTP is not VLAN trunking. 802.1Q trunks carry tagged user frames and provide the Layer 2 path for VTP messages.
  • Centralized propagation can reduce administration while increasing the blast radius of mistakes.

For related study, review VLAN Trunking Protocol concepts and configuration alongside VLAN creation, 802.1Q trunks, spanning tree, and inter-VLAN routing.