Cisco DTP (Dynamic Trunking Protocol) Negotiation

Lessons Discussion
1

This topic is to discuss the following lesson:

2

Thanks Rene very useful

3

Dear René,

Is it to avoid a security issue that we disable DTP ? If someone bring a rogue switch and plug it et voilĂ  we negociate a trunk ?

Thks,

Prince

 

4

Hi Prince,

That’s correct, this could be dangerous if your interface is configured for “dynamic auto” or “dynamic desirable”.

If you configured the interface in static “access” or “trunk” then negotiatin can’t change it anymore but you are still sending DTP packets which is a bit pointless, better to just disable them.

Rene

1 Like
5

Thanks for the reply René,

 

Prince

6

Rene,

Watching you switching videos and I like the background of your terminal. Tale me, which terminal program and font are you using. I would like to use such a background.

 

7

Hi Jesse,

Which video did you see?

For a long time I used Linux Mint (Mate edition) with the mate-terminal to record these videos. It was the default font, not sure which one that was.

Nowadays I use secureCRT configured to use the same colors as Pycharm’s darcula (I liked their colors):

950Ă—571

Here’s a screenshot of what my SecureCRT looks like:

I’m not sure if this is the best for videos but it’s easy on the eyes, even after hours of hardcore Cisco console work :slight_smile:

Rene

1 Like
8

Very good information.

9

thank you
Rene
your wonderful

10

You are welcome Hussein.

11

Hi Rene,

Can you explain me what does it mean Trunking negotiation is ON does it means that this particular mode is set to send DTP frames . to the my knowledge only Dynamic desirable and ON mode will send out DTP frames and other modes are doesn’t (Dynamic Auto and Access)

12

Hello Ankit

When we say that DTP negotiation is ON, it means that the port is in a state where, if the proper DTP packets are sent/received, the port may change its trunking functionality. Negotiation is ON in the following states: Dynamic Desirable, Dynamic Auto or Trunk.

DTP negotiation is OFF when a port is in one of the following states: Access or Non-negotiate.

As for the exchanging of DTP frames, these are sent when a port is in the following states: Dynamic Desirable and Trunk.

DTP frames are NOT sent when a port is configured as Dynamic Auto, Non-negotiate or Access.

So, even if a port is in Dynamic Auto and doesn’t send DTP frames, it is still considered Negotiation ON because it can be affected by the DTP frames it receives.

I hope this has been helpful!

Laz

3 Likes
15

We use Switchport no negotiate only on Trunks ? Or we use it on access ports as well ?
Thanks

16

Hello Abdul

When you configure a port to function as a trunk using the switchport mode trunk command, you are hardwiring that port to function as a trunk. However, it will still send out DTP messages to the other side of the link, and if that side of the link is configured to listen and respond to DTP messages (set to dynamic auto or desireable) it will automatically become a trunk.

By using the switchport nonegotiate command, you disable the sending of any DTP messages completely.

I hope this has been helpful!

Laz

1 Like
17

Hello Abdul

The switchport nonegotiate command is only applied on trunk ports. DTP is automatically disabled on ports that are manually configured as access ports.

I hope this has been helpful!

Laz

18

Hi Rene/Laz,

If we are having trunk mode both side but DTP is disabled means trunking is off, is that mean frame received by switch will be normal frame not tagged one then how frames will be processed by switches b/w each other?

19

Hello Pradyumna

If you disable DTP, this doesn’t mean that trunking is off. This means that trunk negotiation is off. You can still manually configure a port to function as a trunk simply by using the switchport trunk command.

Whether or not a frame on a particular link will have a tag or not depends on the state in which the link finds itself. If DTP is off, then it depends on the configured switchport mode on the egress port. If DTP is on, then it depends on the result of the negotiation.

I hope this has been helpful!

Laz

20

Hi Laz,

If we hard coding the interface as a trunk on both side and disable DTP then how interfaces will react as trunk or access and if we are disabling DTP when interfaces are in trunk mode why is this required?

21

Hello Pradyumna

There are only two ways to disable DTP:

  • configure the port for access mode
  • use the switchport nonegotiate command

If you configure a port as a trunk, you are not disabling DTP. You are hard coding the port to trunk, but the port will still send out DTP messages to the other end saying “I’m a trunk, please become a trunk too!” This means that if there is a port on the other end where DTP has not been disabled, and where it has not been manually configured, it will automatically become a trunk.

I hope this has been helpful!

Laz

22

Mean when port the port is hardcoded Trunk as well as DTP disabled, port will always be Trunk port but we have to configure it at both sides.