Lesson Contents
Most people think that only a VTP server can change the VLAN database in a VTP domain. A VTP client can’t create, change, or delete VLANs, so how could it ever cause any harm?
VTP doesn’t care about the mode of the switch that sends an advertisement. It only looks at the configuration revision number. When a switch receives an advertisement for its own VTP domain with a higher revision number, it replaces its VLAN database with the one it received. This is true for VTP clients and VTP servers.
If you connect a switch with a higher revision number to your network, it can overwrite the VLAN database of every VTP server and VTP client in the domain, even when that switch is a VTP client. Only switches in VTP transparent mode keep their own VLANs. This is sometimes called a “VTP bomb”. In this lesson, I’ll show you how this works.
Configuration
We’ll use three switches, all running IOSvL2 with VTP version 2.
Topology
SW1 and SW2 are our “production” network. SW3 is a switch that someone used in a lab and now wants to add to the network. We’ll configure SW3 on its own first, and connect it later.
Configure the VTP server (SW1)
First, let’s shut the interface that connects to SW3. This way, SW3 isn’t part of the network yet:
SW1(config)#interface GigabitEthernet0/1
SW1(config-if)#shutdown
SW1(config-if)#exitNow we configure the VTP domain, version, and mode, and turn the interface to SW2 into a trunk. VTP advertisements are only sent on trunk links:
SW1(config)#vtp domain NWL
Changing VTP domain name from NULL to NWL
SW1(config)#vtp version 2
SW1(config)#vtp mode server
Device mode already VTP Server for VLANS.
SW1(config)#interface GigabitEthernet0/0
SW1(config-if)#switchport trunk encapsulation dot1q
SW1(config-if)#switchport mode trunkConfigure the VTP client (SW2)
SW2(config)#vtp domain NWL
Domain name already set to NWL.
SW2(config)#vtp version 2
SW2(config)#vtp mode client
Setting device to VTP Client mode for VLANS.
SW2(config)#interface GigabitEthernet0/0
SW2(config-if)#switchport trunk encapsulation dot1q
SW2(config-if)#switchport mode trunkNotice the “Domain name already set to NWL” message. A switch without a VTP domain name takes the domain name from the first VTP advertisement it receives, so SW2 already learned it from SW1. But how, if VTP advertisements are only sent on trunk links? The interface of SW2 uses the default switchport mode dynamic auto. Once we configured SW1 as a trunk, DTP negotiated a trunk between the two switches before we configured anything on SW2.
Create VLANs on the VTP server
Let’s create some VLANs on SW1:
SW1(config)#vlan 10
SW1(config-vlan)#name SALES
SW1(config-vlan)#exit
SW1(config)#vlan 20
SW1(config-vlan)#name ENGINEERING
SW1(config-vlan)#exit
SW1(config)#vlan 30
SW1(config-vlan)#name MANAGEMENT
SW1(config-vlan)#exitLet’s look at the output of show vtp status on SW1:
SW1#show vtp status
VTP Version capable : 1 to 3
VTP version running : 2
VTP Domain Name : NWL
VTP Pruning Mode : Disabled
VTP Traps Generation : Disabled
Device ID : 5254.00c0.8000
Configuration last modified by 0.0.0.0 at 10-26-26 16:58:13
Local updater ID is 0.0.0.0 (no valid interface found)
Feature VLAN:
--------------
VTP Operating Mode : Server
Maximum VLANs supported locally : 1005
Number of existing VLANs : 8
Configuration Revision : 4
MD5 digest : 0xE4 0x1D 0xA4 0xA0 0x1C 0x73 0x35 0x3F
0x81 0x25 0x41 0x0D 0xC4 0x1A 0x8E 0x84SW1 has configuration revision 4. Every change to the VLAN database increases the revision number by one. We only created three VLANs, so where does the fourth change come from? The vtp version 2 command also counts as a change. Let’s check SW2:
SW2#show vtp status
VTP Version capable : 1 to 3
VTP version running : 2
VTP Domain Name : NWL
VTP Pruning Mode : Disabled
VTP Traps Generation : Disabled
Device ID : 5254.0017.8000
Configuration last modified by 0.0.0.0 at 10-26-26 16:58:13
Feature VLAN:
--------------
VTP Operating Mode : Client
Maximum VLANs supported locally : 1005
Number of existing VLANs : 8
Configuration Revision : 4
MD5 digest : 0xE4 0x1D 0xA4 0xA0 0x1C 0x73 0x35 0x3F
0x81 0x25 0x41 0x0D 0xC4 0x1A 0x8E 0x84SW2#show vlan brief
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active
10 SALES active
20 ENGINEERING active
30 MANAGEMENT active
1002 fddi-default act/unsup
1003 trcrf-default act/unsup
1004 fddinet-default act/unsup
1005 trbrf-default act/unsupSW2 has the same revision number (4) and the same MD5 digest, and it learned VLANs 10, 20, and 30. Our production network is in sync.
Prepare the “lab” switch (SW3)
Now let’s configure SW3. Imagine that someone used this switch in a lab with the same VTP domain name. We’ll make it a VTP server, create some VLANs, and configure the trunk:
SW3(config)#vtp domain NWL
Changing VTP domain name from NULL to NWL
SW3(config)#vtp version 2
SW3(config)#vtp mode server
Device mode already VTP Server for VLANS.
SW3(config)#vlan 100
SW3(config-vlan)#name LAB100
SW3(config-vlan)#exit
SW3(config)#vlan 200
SW3(config-vlan)#name LAB200
SW3(config-vlan)#exit
SW3(config)#vlan 300
SW3(config-vlan)#name LAB300
SW3(config-vlan)#exit
SW3(config)#vlan 400
SW3(config-vlan)#name LAB400
SW3(config-vlan)#exit
SW3(config)#vlan 500
SW3(config-vlan)#name LAB500
SW3(config-vlan)#exit
SW3(config)#interface GigabitEthernet0/0
SW3(config-if)#switchport trunk encapsulation dot1q
SW3(config-if)#switchport mode trunk
SW3(config-if)#exitBefore we connect this switch to the network, we change it to VTP client mode with vtp mode client. Many people think this makes it “safe”:
SW3(config)#vtp mode client
Setting device to VTP Client mode for VLANS.Let’s look at SW3:
SW3#show vtp status
VTP Version capable : 1 to 3
VTP version running : 2
VTP Domain Name : NWL
VTP Pruning Mode : Disabled
VTP Traps Generation : Disabled
Device ID : 5254.0025.8000
Configuration last modified by 0.0.0.0 at 10-26-26 16:58:28
Feature VLAN:
--------------
VTP Operating Mode : Client
Maximum VLANs supported locally : 1005
Number of existing VLANs : 10
Configuration Revision : 6
MD5 digest : 0xF2 0x1E 0xD5 0x66 0x80 0x33 0x83 0x35
0xFF 0x65 0x1D 0x55 0x94 0x02 0xC4 0x0ESW3#show vlan brief
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active
100 LAB100 active
200 LAB200 active
300 LAB300 active
400 LAB400 active
500 LAB500 active
1002 fddi-default act/unsup
1003 trcrf-default act/unsup
1004 fddinet-default act/unsup
1005 trbrf-default act/unsupSW3 is a VTP client, but it still has configuration revision 6. Changing the mode from server to client doesn’t reset the revision number. SW3’s revision number is higher than the revision number of our production network (4).
Enable debugging on the VTP server
Before we connect SW3, let’s enable a debug on SW1 so we can see what happens when the VTP advertisement from SW3 arrives:
SW1#debug sw-vlan vtp events
vtp events debugging is onThere are a couple of VTP debug commands. Here is why we use this one:
debug sw-vlan vtp eventsshows each VTP advertisement that the switch receives and sends, the revision number in it, and the result of the revision number comparison. This is exactly what we want to see.debug sw-vlan vtp packetsshows a hex dump of every VTP packet that the switch sends and receives. A single advertisement produces dozens of lines of hex, and it doesn’t show the revision number comparison. You don’t need it for this lab.debug sw-vlan vtp xmitonly shows the advertisements that the switch transmits, so you won’t see the incoming advertisement from SW3.
Connect SW3 to the network
Let’s connect SW3 by running no shutdown on the interface of SW1:
SW1(config)#interface GigabitEthernet0/1
SW1(config-if)#switchport trunk encapsulation dot1q
SW1(config-if)#switchport mode trunk
SW1(config-if)#no shutdownOnce the trunk is up, SW3 sends its VTP advertisement to SW1. Let’s see what happens.