VTP

VTP stands for VLAN Trunking Protocol. Unlike the name implies, VTP is used for replication of VLAN information. That means, we just need to create VLANs or edit VLAN information only on one switch. Then VTP will transfer that information through the trunk link to all other switches which make the administration centralized.

VTP works based on the revision number. By default, VTP revision number is 0 on all switches. If we change any VLAN information on a switch, like… adding VLAN, deleting VLAN, renaming VLAN, etc.. the revision number increases. When other switches get the VTP update, it check the VTP revision number contained in the update with its on VTP revision number. If the local revision number is lower than the one it received, it replace the whole VLAN database with the currently received database.

VTP has three modes – Server, Client and Transparent. Depending upon VTP mode in which the switch operates, it gets the features as follows:

• Server(default)
  • Power to change VLAN information
  • Sends and receives VTP updates
  • Saves VLAN configuration

• Client
  • Cannot change VLAN information
  • Sends and receives VTP updates
  • Does not save VLAN configuration

• Transparent
  • Forwards(passes through) VTP updates
  • Does not listen to VTP advertisements i.e.. it does not update its VLAN information using the VTP updates from other switches
  • Power to change local VLAN information
  • Saves VTP configuration (local)

By default cisco switches comes with VTP server mode. Because of there is no VTP Domain name applied to new switches, they act as server for themselves. Also, switches doesn’t participate in VTP until they hear VTP advertisement from another switch.

To see the current VTP status, use the following command

SW1#show vtp status

Now lets make VTP run on every switch as in the figure.

Set VTP management domain name on all switches

SW1# vtp domain TestDomain

SW2# vtp domain TestDomain

SW3# vtp domain TestDomain

Note: If there is no domain name exist in all switches, then if we configure domain name on SW1, all switches get it automatically.

Set VTP mode of each switch

SW1# vtp mode server

SW2# vtp mdoe transparent

SW3# vtp mode client

Set VTP password (optional)

eg: SW1# vtp password P1ssw0rd

Note: if we want to set the password, set it on all switches

Set VTP version

Default VTP version is 1. if we want to change it to version 2, then do the following command on all switches

eg: SW1# vtp version 2

 

VTP synchronization issues

If we accidently connect a switch with higher revision number and same domain name to the network, all the switches will replace their database to it’s database. Then network connection may not available to users.

Solution:

Before attaching the switch to the network, reset its revision number to zero. Do one of the following to reset revision number to 0

• Change VTP mode to transparent, then back to server
• Change VTP domain to a bogus name, then back

Private VLAN

Private VLAN is the technique of dividing single VLAN into different sub VLANs. This is generally used in the ADSL networks. Also, we can use it to simplify the IP address assignment because all ports are in the same subnet, although they are logically separated in the data link layer.

Private VLAN contains two components

1. Primary VLAN, which is the real VLAN
2. Secondary VLANs, which are the sub VLANs

Secondary VLANs can be one of these:

• Isolated
  • Ports associated with this VLAN cannot communicate each other
  • Ports associated with this VLAN cannot communicate with any other private VLAN
  • Ports associated with this VLAN can communicate only with Primary VLAN
• Community
  • Ports associated with this VLAN can communicate each other
  • Ports associated with this VLAN cannot communicate with any other private VLAN
  • Ports associated with this VLAN can communicate only with Primary VLAN

Now lets, Create these VLANs as in the figure

Creating Community VLANs

Sw1(config)# vlan 100

Sw1(config-vlan)#private-vlan community

Sw1(config)# vlan 200

Sw1(config-vlan)#private-vlan community

Creating isolated VLAN

Sw1(config)# vlan 300

Sw1(config-vlan)#private-vlan isolated

Creating primary VLAN and joining it with primary VLAN

Sw1(config)# vlan 500

Sw1(config-vlan)#private-vlan primary

Sw1(config-vlan)#private-vlan association 100,200,300

To proceed to next step, we must understand about different types of ports

There are mainly two types of port in Private VLAN - Promiscuous port and Host port. Host port is further divides into two types - Isolated port and Community port.

• Promiscuous port : This port can communicate with anything connected to primary or secondary VLANs. Usually, router, firewall etc. are connect to this port
• Isolated port: This port connect to hosts within the isolated VLAN. It can only communicate with the promiscuous port
• Community port :  This port connect to hosts within the community VLAN. It can communicate with promiscuous port and other ports in the same community VLAN

Now, lets assign these different types of port to different VLANs we created. Remember, every ports except Promiscuous port are host port. So the VLAN which we assign these ports determines whether it is isolated port or community port.

SW1(config)#int range e0/1 - 2
SW1(config-if-range)#switchport
SW1(config-if-range)#switchport mode private-vlan host
SW1(config-if-range)#switchport private-vlan host-association 500 300

SW1(config)#int range e1/0 - 1
SW1(config-if-range)#switchport
SW1(config-if-range)#switchport private-vlan host-association 500 100

SW1(config)#int range e1/2 - 3
SW1(config-if-range)#switchport
SW1(config-if-range)#switchport private-vlan host-association 500 200

SW1(config)#int e0/0
SW1(config-if)#switchport
SW1(config-if)#switchport mode private-vlan promiscuous
SW1(config-if)#switchport private-vlan mapping 500 100,200,300