VTP in depth: modes, revision numbers, pruning and VTP version 3

What VTP does

Creating the same VLANs on fifty switches by hand is slow and error-prone. The Cisco VLAN Trunking Protocol (VTP) copies the VLAN list from one switch to the rest. Despite the name, it does not create trunks; it only sends its messages over them. Switches share VLAN information only if they have the same domain name (case-sensitive) and, if one is set, the same password.

A server can create, rename and delete VLANs and advertises them. A client cannot change VLANs; it applies what it receives. A transparent switch keeps its own local VLAN list, ignores updates for itself, but passes them on to other switches. Off mode, available in version 3 and some newer version 1 and 2 software, stops the switch relaying VTP at all.

Revision numbers and the classic outage

Every time a server changes the VLAN list, it raises the configuration revision number. Servers send summary advertisements every five minutes and immediately after a change. A switch that hears a higher revision number than its own from its domain replaces its whole VLAN list with the one advertised.

This creates a well-known trap. Suppose a switch taken from a lab has the same domain name and a higher revision number, but only VLAN 1. When it is connected to a production trunk, every other switch believes it holds the newest list and deletes their VLANs. Access ports in deleted VLANs go inactive, and users lose connectivity across the site.

To reset a switch's revision number before connecting it, change it to transparent mode (or change the domain name) and back. Many organisations simply run all switches in transparent mode and manage VLANs with templates or automation instead.

vtp domain CAMPUS
vtp version 2
vtp mode transparent
show vtp status

VTP pruning

By default a trunk carries broadcasts for every VLAN, even to switches that have no ports in it. VTP pruning lets switches tell their neighbours which VLANs they actually need, so flooded traffic for other VLANs is not sent down that trunk. You enable it on the server with vtp pruning and the domain picks it up. VLAN 1 and the reserved VLANs 1002 to 1005 are never pruned. Manually limiting allowed VLANs on each trunk achieves the same result and works without VTP.

VTP version 3

Version 3 keeps the idea but fixes the main weaknesses:

• Primary server: only one switch at a time, promoted with the privileged EXEC command vtp primary, can change VLANs. Other servers are secondary and simply relay and store the database. A switch with a higher revision number can no longer take over just by being plugged in.
• Extended VLANs: VLANs 1006 to 4094 and private VLANs can be advertised, which versions 1 and 2 cannot do.
• Several databases: VTP 3 can also distribute the MST region configuration as a separate instance.
• Hidden password: the password can be stored so that it does not appear in the configuration, and promotion to primary needs it.
• Off mode per switch or per trunk.

vtp domain CAMPUS
vtp version 3
vtp password Lab-Only-Example hidden
vtp mode server
end
vtp primary vlan

Real-world example: the borrowed lab switch

A college IT team borrowed a switch from the networking classroom to replace a faulty one in the library. The classroom switch used the same VTP domain name as production and had a revision number of 212 from student practice. Within seconds of connecting the trunk, the library, staff room and office VLANs disappeared from every switch, because each one accepted the higher revision. The team restored VLANs from saved configurations and then moved the campus to VTP version 3 with the core switch as primary server. Lab switches now use a different domain and are reset before reuse.