DTP
DTP is a Cisco proprietary protocol that allows Cisco switches to dynamically determine their interface status (access or trunk) without manual configuration.
DTP is enabled by default on all Cisco switch interfaces.
For security purposes, manual configuration is recommended. DTP should be disabled on all switchports.
Modes
A switchport in dynamic desirable mode will actively try to form a trunk with other Cisco switches. It will form a trunk if connected to another switchport in the following modes:
switch access means an access port that belongs to a single VLAN that doesn't change (unless you configure a different VLAN).
There are also dynamic access ports, in which a server automatically assigns the VLAN depending on the MAC address of the connected device.
A switchport in dynamic auto mode will not actively try to form a trunk with other Cisco switches, however it will form a trunk if the switch connected to it is actively trying to form a trunk. It will form a trunk with a switchport in the following modes:
DTP will not form a trunk with a router, PC, etc. The switchport will be in access mode.
Disabling DTP
On older switches switchport mode dynamic desirable is the default administrative mode.
On newer switches, switchport mode dynamic auto is the default administrative mode.
You can disable DTP negotiation on an interface with this command: switchport nonegotiate
Configuring an access port with switchport mode access also disables DTP negotiation on an interface.
It is recommended that you disable DTP on all switchport and manually configure them as access or trunk ports.
Trunk Encapsulation Negotiation
Switches that support both 802.1Q and ISL trunk encapsulations can use DTP to negotiate the encapsulation they will use.
This negotiation is enabled by default, as the default trunk encapsulation mode is: switchport trunk encapsulation negotiate.
ISL is favored over 802.1Q, so if both switches support ISL it will be selected.
DTP frames are sent in VLAN1 when using ISL, or in the native VLAN when using 802.1Q (the default VLAN is VLAN1, however).
Last updated