Trunking_Top

No awesome elephant picture for this one, back to the dual Trunk, dual VLAN topology.

Also please note, I have updated the Mode / Encapsulation article as of today 8/26, I had some mis-information I assume from trying to study dead tired that is now updated and correct more importantly ūüôā

Some default information, and the need to know Theory for exam day

DTP is what makes negotiation possible, handling the negotiation between the Trunk ports, and forming the Trunk (hopefully… maybe).

DTP is a Cisco Proprietary point-to-point protocol (Exactly like ISL), and has a cost to the network of sending out DTP frames every 30 seconds to the remote end.

So for exam day – Cisco Proprietary, every 30 seconds (like RIP) by default, and is considered a “point-to-point” protocol as I believe most switch protocols are.

When is a good time to turn DTP off on a port? Probably right now!

The first reason is purely just to cut some overhead, if the switchport is configured in mode “Trunk”, there is no need to run DTP because it is unconditionally attempting to form a trunk with the remote end – So there is no need for DTP frames being sent.

The second reason is if there are devices that cannot form trunks like firewalls or routers not configured for something like Router on a Stick, there is no reason to have DTP running on the port connected to that device.

The third reason is that it is a huge security risk, to have random ports trying to form Trunks with whatever device plugs into it (like a rogue switch controlled by unauthorized persons) to wreak havoc on the network via a rogue switch.

First thing to know for troubleshooting, are some verification commands!

So one of the base / informational commands for DTP is “sh dtp” at user exec level, however it gives you the “global dtp” information:

SW1#sh dtp
Global DTP information
Sending DTP Hello packets every 30 seconds
Dynamic Trunk timeout is 300 seconds
4 interfaces using DTP
SW1#

Why are their 4 interfaces using DTP while I only have 2 trunk ports:

SW1#sh int trunk

Port Mode Encapsulation Status Native vlan
Fa1/0/10 on 802.1q trunking 1
Fa1/0/20 on 802.1q trunking 1

Port Vlans allowed on trunk
Fa1/0/10 1-4094
Fa1/0/20 1-4094

This is where we need to know how to find and verify DTP information on the ports of the switch, with one command that has a LOT of DTP output, but I will post a sample size:

SW1#sh dtp ?
interface DTP interface status
| Output modifiers
<cr>

SW1#sh dtp interface ?
FastEthernet FastEthernet IEEE 802.3
GigabitEthernet GigabitEthernet IEEE 802.3z
| Output modifiers
<cr>

SW1#sh dtp interface
DTP information for FastEthernet1/0/1:
TOS/TAS/TNS: ACCESS/OFF/ACCESS
TOT/TAT/TNT: UNKNOWN/NEGOTIATE/UNKNOWN
Neighbor address 1: 000000000000
Neighbor address 2: 000000000000
Hello timer expiration (sec/state): never/STOPPED
Access timer expiration (sec/state): never/STOPPED
Negotiation timer expiration (sec/state): never/STOPPED
Multidrop timer expiration (sec/state): never/STOPPED
FSM state: S1:OFF
# times multi & trunk 0
Enabled: no
In STP: no

Statistics
———-
0 packets received (0 good)
0 packets dropped
0 nonegotiate, 0 bad version, 0 domain mismatches,
0 bad TLVs, 0 bad TAS, 0 bad TAT, 0 bad TOT, 0 other
0 packets output (0 good)
0 native, 0 software encap isl, 0 isl hardware native
0 output errors
–More–

Unfortunately, and please someone comment if there is a better way to verify which way to see all ports participating in DTP with some type of “sh dtp …” command, but there is no way to see them in a neat little row like “sh ip int brief” shows up all our port numbers and their status.

So if you must dig through them, we can use a verification command we are already used to from digging into encapsulations and modes:

SW1#sh int switchport
Name: Fa1/0/1
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: negotiate
Operational Trunking Encapsulation: native
Negotiation of Trunking: Off
Access Mode VLAN: 12 (VLAN0012)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: none

Issuing the command “sh int switchport” will include a line Negotiation of Trunking: On / Off, and I again thought to myself “Why is there 4 DTP interfaces on the switch with two Trunk ports and that’s it?

Unfortunately, and please correct me if I am wrong, you do need to dig through all the interfaces output of “sh int switchport” unless there is a filter I am not finding. If you know the interface your looking for information you can of course use the modifier “sh int switchport | begin FaX/X” and the output will start from that interface.

So I went through each switchport, and I found a surprising revelation:

Name: Fa1/0/14
Switchport: Enabled
Administrative Mode: dynamic auto
Operational Mode: down
Administrative Trunking Encapsulation: negotiate
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: none

So the more I went down this rabbit hole, the more confused I got about the global “sh dtp” command # of interfaces using DTP. I assume because I have 4 cables in my switch, both ports in VLANs allowed over a trunk maybe that is it.

And then… :

SW1#sh dtp
Global DTP information
Sending DTP Hello packets every 30 seconds
Dynamic Trunk timeout is 300 seconds
5 interfaces using DTP
SW1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
SW1(config)#int fa1/0/18
SW1(config-if)#switchport mode access
SW1(config-if)#do sh dtp
Global DTP information
Sending DTP Hello packets every 30 seconds
Dynamic Trunk timeout is 300 seconds
6 interfaces using DTP
SW1(config-if)#do sh int switchport | b Fa1/0/18
Name: Fa1/0/18
Switchport: Enabled
Administrative Mode: static access
Operational Mode: down
Administrative Trunking Encapsulation: negotiate
Negotiation of Trunking: Off
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: none

It is Negotiation of Trunk is on for every port that I have not issued “switchport mode access” on, but as soon as I issue the command on a port, it disabled Trunk Negotiation but raises the number of interfaces using DTP.

Hmmm… And I cannot find anything at the moment to explain that, just an oddity for right now to keep on pace to finish this post, because we actually want on non-trunk ports not to be attempting Trunk Negotiation by default!

My attempt at how I thought DTP would be disabled first, and the behaviors of it

 

I am going to try for the gold, and go for the entire range of ports, to disable DTP across the entire switch:

SW1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
SW1(config)#int range fa1/0/1 – 24
SW1(config-if-range)#switchport nonegotiate
Command rejected: Conflict between ‘nonegotiate’ and ‘dynamic’ status.
switchport nonegotiate
^
% Invalid input detected at ‘^’ marker.

% Interface range command failed for FastEthernet1/0/2
SW1(config)#

Notice it kicked me out of interface range configuration, and it gave me a couple of errors, one oddly landing on port 2 which actually has not been configured on SW1, as only ports 1 and 3 are part of VLANs 12 and 34.

So searching every inch of the CLI output I could, I found all ports are in “Auto” mode by default, unless changed to “access”, “Trunk with nonegotiate” on the port. I believe because Switchport 1/0/2 is not in use at all so was in an “Auto” mode with is a Dynamic status, and that goofed things up.

So one step at a time here, I am going to try to make my Trunk a non-negotiation port here, to see if we can get something going:

SW1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
SW1(config)#int fa1/0/10
SW1(config-if)#switchport nonegotiate
SW1(config-if)#do sh int switchport | begin Fa1/0/10
Name: Fa1/0/10
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: Off
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: none

Ok, so the command “switchport nonegotiate” is working, but you should be able to do this across a range of ports, so lets see how to accomplish that:

SW1(config-if)#int fa1/0/18
SW1(config-if)#no switchport mode access
SW1(config-if)#int range fa1/0/11 – 19
SW1(config-if-range)#switchport nonegotiate
Command rejected: Conflict between ‘nonegotiate’ and ‘dynamic’ status.
% Range command terminated because it failed on FastEthernet1/0/11
SW1(config-if-range)#

This makes sense to me, as I scrolled through all ports “sh int switchport” output, and they are all set to mode Auto – Also it did not kick me out of int range command this time!

So I will try first making them access ports, and then issuing the command to see if that makes a difference:

SW1(config-if-range)#switchport mode access
SW1(config-if-range)#switchport nonegotiate
SW1(config-if-range)#

No errors, still in int range mode, aaaaand:

SW1(config-if-range)#do sh int switchport | begin Fa1/0/15
Name: Fa1/0/15
Switchport: Enabled
Administrative Mode: static access
Operational Mode: down
Administrative Trunking Encapsulation: negotiate
Negotiation of Trunking: Off
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: none

However if I look at a completely untouched interface Fa1/0/24:

SW1(config-if-range)#do sh int switchport | begin Fa1/0/24
Name: Fa1/0/24
Switchport: Enabled
Administrative Mode: dynamic auto
Operational Mode: down
Administrative Trunking Encapsulation: negotiate
Negotiation of Trunking: On

Then once it becomes an access port with “switchport mode access”:

SW1(config-if-range)#int fa1/0/24
SW1(config-if)#switchport mode access
SW1(config-if)#do sh int switchport | begin Fa1/0/24
Name: Fa1/0/24
Switchport: Enabled
Administrative Mode: static access
Operational Mode: down
Administrative Trunking Encapsulation: negotiate
Negotiation of Trunking: Off

.In an access ports case, the “switchport mode access” command is telling the port you are permanently a non-Trunk port until I tell you further, so it also turns off Negotiation and shows the mode as “Static Access” and Negotiation of Trunk as “Off”.

However Trunk ports will start out with Negotiation set to “On”, and need to be disabled on the interface level to not use DTP, that is why we see Negotiation on at first, then off after we issue “switchport nonegotiation”.

The access ports portion is really an addition to this, as we are mainly concerned about learning this for our Trunks, but I wanted to demonstrate that thoroughly.

Now lets see what kind of havoc we have wreaked on SW2 on the trunking side

I believe this side had the trunk end that I changed to encapsulation negotiation:

SW2#sh int trunk
SW2#

Sure enough, taking away negotiation from those trunks on SW1 dropped the Trunk to SW2, however there is a way to view ports that are in a Trunking mode but not currently trunking:

 

SW2(config-if)#do sh int fa1/0/10 trunk

Port          Mode     Encapsulation    Status          Native vlan
Fa1/0/10    auto        negotiate        not-trunking       1

Port Vlans allowed on trunk
Fa1/0/10 1

Port Vlans allowed and active in management domain
Fa1/0/10 1

Port Vlans in spanning tree forwarding state and not pruned
Fa1/0/10 none
SW2(config-if)#

This is very important to note as far as Trunk troubleshooting commands, to find configured trunks that are not active!

However, of course:

SW2(config-if)#do sh int trunk
SW2(config-if)#

Obviously because we set the other side not to negotiate, and these encapsulations are literally “negotiate”, so to solve this issue we simply need to heed the errors warning we have been seeing throughout VLAN’s (Command rejected: Something Something Auto and Trunk), and make these full on Trunk ports:

SW2(config-if)#int fa1/0/10
SW2(config-if)#switchport trunk encap dot1q
SW2(config-if)#switchport mode trunk
SW2(config-if)#
*Mar 1 01:43:29.423: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0/10, changed state to down
*Mar 1 01:43:32.443: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0/10, changed state to up
SW2(config-if)#int fa1/0/20
SW2(config-if)#switchpor trunk encap dot1q
SW2(config-if)#switchport mode trunk
SW2(config-if)#
*Mar 1 01:43:59.270: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0/20, changed state to down
*Mar 1 01:44:02.298: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0/20, changed state to up
SW2(config-if)#do sh int trunk

Port              Mode    Encapsulation  Status    Native vlan
Fa1/0/10          on            802.1q           trunking      1
Fa1/0/20          on            802.1q           trunking      1

There we have it. Best practice would be to issue “switchport nonegotiate” on SW2 as well but I’ll spare the output at this point, as that is all the DTP I can take.

However there is one last important point, on how to get the mode “Off” or turn off DTP all together – By turning a port into an Access Port with “switchport mode access”. I ran into it earlier but didn’t want the extra output, however to actually completely disable DTP on a port, just configure it as an access port and you’ll notice under “sh int fax/x trunk” it shows “Off” under the mode:

SW2(config-if)#do sh int fa1/0/2 trunk

Port         Mode   Encapsulation       Status            Native vlan
Fa1/0/2      off        negotiate         not-trunking          1

So the only two ways to turn off DTP completely on a port is:

  • switchport mode access
  • switchport nonegotiate (on a Trunk port)

That is now officially all the DTP I can take for this lab and wraps up the subject, next will be filtering VLANs from crossing trunks, until next time!