VLAN Trunking Protocol (VTP): The Complete Guide

VLAN Trunking Protocol (VTP) is a Cisco proprietary Layer 2 messaging protocol designed to automate VLAN management across switched campus networks.

In mid-to-large corporate infrastructures containing dozens of switches, manual VLAN provisioning introduces severe operational overhead and misconfigurations. VTP allows network administrators to create, edit, or remove VLAN definitions on a central switch and synchronize that database across all connected trunk lines automatically.

The Enterprise Problem: Manual Scaling

Consider a enterprise campus containing 40 switches requiring 10 departmental VLANs:

Configuration Overhead: 40 Switches × 10 VLANs = 400 manual configurations.
Black-Hole Traffic: Switches only forward traffic across trunk lines for VLANs registered inside their local VLAN database (vlan.dat). Forgetting to define a VLAN on an intermediate distribution switch breaks connectivity for all downstream devices.
Human Error: Typographical errors in VLAN naming or ID assignment create broken Layer 2 broadcast boundaries.

The 3 Operating Modes of VTP

Every switch participating in a VTP domain operates in one of three primary modes:

Feature	Server Mode (Default)	Client Mode	Transparent Mode
Create / Edit / Delete VLANs	Yes	No (Locked out)	Yes (Locally only)
Database Storage	NVRAM / Flash (`vlan.dat`)	RAM (Cleared on reboot)	NVRAM / Flash (`vlan.dat`)
Synchronizes with Domain?	Yes	Yes	No (Maintains local list)
Forwards VTP Advertisements?	Yes	Yes	Yes (Transit pass-through)

Core Prerequisites for Synchronization

For switches to exchange VTP summary and subset advertisements successfully, three criteria must match:

Domain Name: An identical, case-sensitive VTP domain string configured on all devices.
Password (Optional but Recommended): A shared authentication secret across the domain.
Operational Trunk Links: VTP advertisements travel exclusively across active 802.1Q trunk interfaces. Access links drop VTP frames.

VTP Synchronization Architecture

 +--------------------+               +-------------------------+               +--------------------+
 |   SW1 (SERVER)     |               |    SW2 (TRANSPARENT)    |               |    SW3 (CLIENT)    |
 | Domain: CCNA_LAB   |               | Domain: CCNA_LAB        |               | Domain: CCNA_LAB   |
 | Revision: 5        |               | Revision: 0 (Ignored)   |               | Revision: 5        |
 +---------+----------+               +------------+------------+               +---------+----------+
           |                                       |                                      |
     [Gig 0/1] (Trunk)                       [Gig 0/1] (Trunk)                      [Gig 0/1] (Trunk)
           |                                       |                                      |
           +=======================================+======================================+
                         VTP Advertisements Sent Across 802.1Q Trunks
           [creates VLAN 10-40]   ---->       (Forwards without sync)      ---->   [Auto-learns 10-40]

The Configuration Revision Number Trap

Every time a VLAN modification occurs on a VTP Server, the switch increments its Configuration Revision Number by +1. Switches always evaluate the advertisement containing the highest revision number as the absolute network truth.

The Disaster: If a used switch from a test lab with a higher revision counter (e.g., Rev 25) is introduced to a live network (Rev 5) with a matching domain name, all live switches overwrite their active database with the lab switch's database, wiping out production VLANs in seconds.

Prevention: Always reset the revision number to 0 before connecting an unverified switch by changing its VTP domain name to a dummy name and back, or toggling its mode to transparent.

Cisco CLI Configuration Example

1. Core Server Configuration (SW1)

SW1# configure terminal
SW1(config)# vtp domain CCNA_LAB
SW1(config)# vtp password CiscoSecurePass
SW1(config)# vtp mode server
SW1(config)# vlan 10
SW1(config-vlan)# name Sales
SW1(config-vlan)# vlan 20
SW1(config-vlan)# name Engineering
SW1(config-vlan)# end
SW1# write memory

2. Client Configuration (SW3)

SW3# configure terminal
SW3(config)# vtp domain CCNA_LAB
SW3(config)# vtp password CiscoSecurePass
SW3(config)# vtp mode client
SW3(config)# end
SW3# write memory

Essential Verification Commands

show vtp status — Displays the operating mode, domain name, VTP version, and current Configuration Revision Number.
show vtp password — Displays the configured VTP MD5 authentication string.
show vlan brief — Confirms whether the VLAN database was successfully populated via incoming VTP updates.

Embedded Image

🛠️ Hands-On Cisco Packet Tracer Lab Files

Test VTP Server, Client, and Transparent modes directly in your own virtual lab environment:

⬇️ Download VTP Lab (.pkt)

VLAN Trunking Protocol (VTP)