Table of Contents. Cisco Understanding and Configuring VLAN Trunk Protocol (VTP)

Transcription

1 Table of Contents Understanding and Configuring VLAN Trunk Protocol (VTP)...1 Document ID: Interactive: This document offers customized analysis of your Cisco device...1 This document contains Flash animation...1 Introduction...2 Prerequisites...2 Requirements...2 Components Used...2 Conventions...2 Understand VTP...2 Flash Animation: VTP...2 VTP Messages in Detail...3 Other VTP Options...6 VTP V2...6 VTP Password...6 VTP Pruning...6 Use VTP in a Network...6 VTP Configuration on Catalyst Switches...7 Catalyst 6500/6000 Series Cisco IOS Software/Catalyst 4500/4000 Cisco IOS Software (Supervisor Engine III/Supervisor Engine IV), Catalyst 2950, 3550, and 3750 Series Switches...7 Catalyst 4500/4000, 5500/5000, or 6500/6000 Series CatOS...8 Catalyst 2900XL, 3500XL, 2950, and Catalyst Express 500 Series Switches...9 Practical Examples...9 VTP Troubleshooting and Caveats...17 Unable to See VLAN Details in the show run Command Output...17 Catalyst Switches Do Not Exchange VTP Information...18 Catalyst Switch Automatically Changes VTP Mode from Client to Transparent...19 CatOS Switch Changes to VTP Transparent Mode, VTP 4 UNSUPPORTEDCFGRCVD:...20 How a Recently Inserted Switch Can Cause Network Problems...23 All Ports Inactive After Power Cycle...27 Trunk Down, Which Causes VTP Problems...28 VTP and STP (Logical Spanning Tree Port)...28 The Case of VLAN Troubleshoot VTP Configuration Revision Number Errors That Are Seen in the show vtp statistics Command Output...30 Troubleshoot VTP Configuration Digest Errors That Are Seen in the show vtp statistics Command Output...31 Conclusion...32 NetPro Discussion Forums Featured Conversations...32 Related Information...32 i

2 Understanding and Configuring VLAN Trunk Protocol (VTP) Document ID: Interactive: This document offers customized analysis of your Cisco device. This document contains Flash animation. Introduction Prerequisites Requirements Components Used Conventions Understand VTP Flash Animation: VTP VTP Messages in Detail Other VTP Options VTP V2 VTP Password VTP Pruning Use VTP in a Network VTP Configuration on Catalyst Switches Catalyst 6500/6000 Series Cisco IOS Software/Catalyst 4500/4000 Cisco IOS Software (Supervisor Engine III/Supervisor Engine IV), Catalyst 2950, 3550, and 3750 Series Switches Catalyst 4500/4000, 5500/5000, or 6500/6000 Series CatOS Catalyst 2900XL, 3500XL, 2950, and 3550 Catalyst Express 500 Series Switches Practical Examples VTP Troubleshooting and Caveats Unable to See VLAN Details in the show run Command Output Catalyst Switches Do Not Exchange VTP Information Catalyst Switch Automatically Changes VTP Mode from Client to Transparent CatOS Switch Changes to VTP Transparent Mode, VTP 4 UNSUPPORTEDCFGRCVD: How a Recently Inserted Switch Can Cause Network Problems All Ports Inactive After Power Cycle Trunk Down, Which Causes VTP Problems VTP and STP (Logical Spanning Tree Port) The Case of VLAN 1 Troubleshoot VTP Configuration Revision Number Errors That Are Seen in the show vtp statistics Command Output Troubleshoot VTP Configuration Digest Errors That Are Seen in the show vtp statistics Command Output Conclusion NetPro Discussion Forums Featured Conversations Related Information

3 Introduction VLAN Trunk Protocol (VTP) reduces administration in a switched network. When you configure a new VLAN on one VTP server, the VLAN is distributed through all switches in the domain. This reduces the need to configure the same VLAN everywhere. VTP is a Cisco proprietary protocol that is available on most of the Cisco Catalyst series products. Note: This document does not cover VTP Version 3. VTP Version 3 differs from VTP Version 1 (V1) and Version 2 (V2), and it is only available on Catalyst OS (CatOS) 8.1(1) or later. VTP Version 3 incorporates many changes from VTP V1 and V2. Make certain that you understand the differences between VTP Version 3 and prior versions before you alter your network configuration. For more information, refer to one of these sections of the document Configuring Understanding How VTP Version 3 Works Interaction with VTP Version 1 and VTP Version 2 (VTP Version 3) Prerequisites Requirements There are no specific requirements for this document. Components Used This document is not restricted to specific software or hardware versions. Conventions Refer to Cisco Technical Tips Conventions for more information on document conventions. Understand VTP Flash Animation: VTP Refer to the VTP Flash animation, which explains these concepts for VTP V1 and V2: Introduction to VTP VTP domain and VTP modes Common VTP problems and solutions Note: This document does not cover VTP Version 3. VTP Version 3 differs from VTP V1 and V2 and is only available on CatOS 8.1(1) or later. For more information, refer to one of these sections of the document Configuring Understanding How VTP Version 3 Works Interaction with VTP Version 1 and VTP Version 2 (VTP Version 3)

4 VTP Messages in Detail VTP packets are sent in either Inter Switch Link (ISL) frames or in IEEE 802.1Q (dot1q) frames. These packets are sent to the destination MAC address C CC CC CC with a logical link control (LLC) code of Subnetwork Access Protocol (SNAP) (AAAA) and a type of 2003 (in the SNAP header). Here is the format of a VTP packet that is encapsulated in ISL frames: Of course, you can have a VTP packet inside 802.1Q frames. In that case, the ISL header and cyclic redundancy check (CRC) is replaced by dot1q tagging. Now consider the detail of a VTP packet. The format of the VTP header can vary, based on the type of VTP message. However, all VTP packets contain these fields in the header: VTP protocol version: 1, 2, or 3 VTP message types: Summary advertisements Subset advertisement Advertisement requests VTP join messages Management domain length Management domain name Configuration Revision Number The configuration revision number is a 32 bit number that indicates the level of revision for a VTP packet. Each VTP device tracks the VTP configuration revision number that is assigned to it. Most of the VTP packets contain the VTP configuration revision number of the sender. This information is used to determine whether the received information is more recent than the current version. Each time that you make a VLAN change in a VTP device, the configuration revision is incremented by one. In order to reset the configuration revision of a switch, change the VTP domain name, and then change the name back to the original name. Summary Advertisements By default, Catalyst switches issue summary advertisements in 5 minute increments. Summary advertisements inform adjacent Catalysts of the current VTP domain name and the configuration revision number. When the switch receives a summary advertisement packet, the switch compares the VTP domain name to its own VTP domain name. If the name is different, the switch simply ignores the packet. If the name is the same, the switch then compares the configuration revision to its own revision. If its own configuration revision is

5 higher or equal, the packet is ignored. If it is lower, an advertisement request is sent. This list clarifies the meaning of the fields in the summary advertisement packet: The Followers field indicates that this packet is followed by a Subset Advertisement packet. The Updater Identity is the IP address of the switch that is the last to have incremented the configuration revision. The Update Timestamp is the date and time of the last increment of the configuration revision. Message Digest 5 (MD5) carries the VTP password, if MD5 is configured and used to authenticate the validation of a VTP update. Subset Advertisements When you add, delete, or change a VLAN in a Catalyst, the server Catalyst where the changes are made increments the configuration revision and issues a summary advertisement. One or several subset advertisements follow the summary advertisement. A subset advertisement contains a list of VLAN information. If there are several VLANs, more than one subset advertisement can be required in order to advertise all the VLANs.

6 This formatted example shows that each VLAN information field contains information for a different VLAN. It is ordered so that lowered valued ISL VLAN IDs occur first: Most of the fields in this packet are easy to understand. These are two clarifications: CodeThe format for this is 0x02 for subset advertisement. Sequence numberthis is the sequence of the packet in the stream of packets that follow a summary advertisement. The sequence starts with 1. Advertisement Requests A switch needs a VTP advertisement request in these situations: The switch has been reset. The VTP domain name has been changed. The switch has received a VTP summary advertisement with a higher configuration revision than its own. Upon receipt of an advertisement request, a VTP device sends a summary advertisement. One or more subset advertisements follow the summary advertisement. Here is an example:

7 CodeThe format for this is 0x03 for an advertisement request. Start ValueThis is used in cases in which there are several subset advertisements. If the first (n) subset advertisement has been received and the subsequent one (n+1) has not been received, the Catalyst only requests advertisements from the (n+1)th one. Other VTP Options VTP V2 VTP V2 is not much different than VTP V1. The major difference is that VTP V2 introduces support for Token Ring VLANs. If you use Token Ring VLANs, you must enable VTP V2. Otherwise, there is no reason to use VTP V2. VTP Password If you configure a password for VTP, you must configure the password on all switches in the VTP domain. And the password must be the same password on all those switches. The VTP password that you configure is translated by algorithm into a 16 byte word (MD5 value) that is carried in all summary advertisement VTP packets. VTP Pruning VTP ensures that all switches in the VTP domain are aware of all VLANs. However, there are occasions when VTP can create unnecessary traffic. All unknown unicasts and broadcasts in a VLAN are flooded over the entire VLAN. All switches in the network receive all broadcasts, even in situations in which few users are connected in that VLAN. VTP pruning is a feature that you use to eliminate (or prune) this unnecessary traffic. Use VTP in a Network By default, all switches are configured to be VTP servers. This configuration is suitable for small scale networks in which the size of the VLAN information is small and the information is easily stored in all switches (in NVRAM). In a large network, the network administrator must make a judgment call at some point, when the NVRAM storage that is necessary is wasteful because it is duplicated on every switch. At this point, the network administrator must choose a few well equipped switches and keep them as VTP servers. Everything else that participates in VTP can be turned into a client. The number of VTP servers should be chosen to provide the degree of redundancy that is desired in the network. Notes:

8 If a switch is configured as a VTP server without a VTP domain name, you cannot configure a VLAN on the switch. If a new Catalyst is attached in the border of two VTP domains, the new Catalyst keeps the domain name of the first switch that sends it a summary advertisement. The only way to attach this switch to another VTP domain is to manually set a different VTP domain name. Dynamic Trunking Protocol (DTP) sends the VTP domain name in a DTP packet. Therefore, if you have two ends of a link that belong to different VTP domains, the trunk does not come up if you use DTP. In this special case, you must configure the trunk mode as on or nonegotiate, on both sides, in order to allow the trunk to come up without DTP negotiation agreement. If the domain has a single VTP server and it crashes, the best and easiest way to restore the operation is to change any of the VTP clients in that domain to a VTP server. The configuration revision will still be the same in the rest of the clients, even if the server crashes. Therefore, VTP will work properly in the domain. VTP Configuration on Catalyst Switches This section provides some basic commands to configure VTP on the most commonly used Catalyst switches. Note: The Catalyst 2948G L3 and Catalyst 4908G L3 Layer 3 (L3) switches do not support several Layer 2 (L2) oriented protocols that are found on other Catalyst switches. Such protocols include VTP, DTP, and Port Aggregation Protocol (PAgP). Catalyst 6500/6000 Series Cisco IOS Software/Catalyst 4500/4000 Cisco IOS Software (Supervisor Engine III/Supervisor Engine IV), Catalyst 2950, 3550, and 3750 Series Switches There are two methods that you can use to configure VTP, as this section shows. Method 2 (the global configuration mode method) is not available in earlier software on Catalyst 6500 series switches that run Cisco IOS Software. 1. In VLAN database mode: In Cisco IOS Software, you can configure the VTP domain name, the VTP mode, and the VLANs in VLAN configuration mode. a. In EXEC mode, issue this command in order to enter VLAN configuration mode: Router#vlan database! Issue this command in privileged EXEC mode,! not in global configuration mode. Router(vlan)#! This is VLAN configuration mode. b. In order to set the VTP domain name, issue this command: Router(vlan)#vtp mode {client server transparent} c. In order to exit VLAN configuration mode, issue the exit command. Note: The end command and the Ctrl Z command do not work in this mode.

9 2. Router(vlan)#end Router(vlan)#^Z % Invalid input detected at '^' marker. Router(vlan)# Router(vlan)#exit APPLY completed. Exiting... Router# In global configuration mode: In Cisco IOS Software global configuration mode, you can configure all VTP parameters with Cisco IOS Software commands. This is the command format: Router(config)#vtp? domain Set the name of the VTP administrative domain. file Configure IFS filesystem file where VTP configuration is stored. interface Configure interface as the preferred source for the VTP IP updater address. mode Configure VTP device mode password Set the password for the VTP administrative domain pruning Set the administrative domain to permit pruning version Set the administrative domain to VTP version In order to monitor VTP operation and status, issue these commands: Router#show vtp status Router#show vtp counters Catalyst 4500/4000, 5500/5000, or 6500/6000 Series CatOS In order to set the domain name, issue this command: set vtp domain name In order to set the mode, issue this command: set vtp mode [server client transparent] In order to monitor the VTP operation and status, issue these commands: show vtp domain show vtp status Catalyst 2900XL, 3500XL, 2950, and 3550 From the VLAN database mode, issue these commands: Note: This is similar to the method for Cisco 6500 series switches that run Cisco IOS Software. vtp [client server transparent]

10 vtp domain name From enable mode, issue these commands in order to monitor VTP operation: show vtp counters show vtp status Note: The Catalyst 2900XL series switches with Cisco IOS Software Release 11.2(8)SA4 and later support VTP protocol. The Cisco IOS Software Release 11.2(8)SA3 and earlier code do not support VTP protocol on Catalyst 2900XL series switches. Catalyst Express 500 Series Switches Catalyst Express 500 series switches support only VTP transparent mode. There is currently no support for VTP client or VTP server mode. The user must manually configure all VLANs that will be used on the switch. In order to configure a VLAN on a Catalyst Express 500 series switch, open the switch management GUI, click Configure > VLAN > Create, and fill out the available fields. For more information, refer to the Create, Modify, and Delete VLANs section of Customization (User Guide for the Catalyst Express 500 Switches). Practical Examples This first example involves two Catalyst 4000 switches that are connected by a Fast Ethernet link: 1. Bing is a new switch that has no VTP domain name and no VLAN. Clic is an existing, running switch with 12 VLANs in the VTP domain "test". 2. In this sample output from the show vtp domain command, you can see that the VTP version is set at 2. This means that the switch is VTP V2 capable. But the switch does not run VTP V2 in this case. The switch only runs VTP V2 if the V2 mode is enabled with the set vtp v2 enable command: bing (enable) show vtp domain Domain Name Domain Index VTP Version Local Mode Password 1 2 server Vlan count Max vlan storage Config Revision Notifications disabled Last Updater V2 Mode Pruning PruneEligible on Vlans disabled disabled bing (enable) bing (enable) show vlan VLAN Name Status IfIndex Mod/Ports, Vlans 1 default active 67 2/1 2,2/4 48 3/ fddi default active token ring default active fddinet default active 69

11 trnet default active 70 clic (enable) show vtp domain Domain Name Domain Index VTP Version Local Mode Password test 1 2 server Vlan count Max vlan storage Config Revision Notifications disabled Last Updater V2 Mode Pruning PruneEligible on Vlans disabled disabled clic (enable) show vlan VLAN Name Status IfIndex Mod/Ports, Vlans 1 default active 65 2/1 2,2/ VLAN0002 active 77 3 VLAN0003 active 78 2/3 4 VLAN0004 active 79 5 VLAN0005 active 73 6 VLAN0006 active 74 7 VLAN0007 active VLAN0010 active fddi default active token ring default active fddinet default active trnet default active At this stage, a trunk is created between the two switches. Notice how they synchronize and watch the VTP packet exchange: MAC BB63FD is clic MAC CFD is bing 4. Clic sends a summary advertisement to bing. Bing learns the VTP domain name from this packet (in FRAME 1 in this sample output):! On bing: received vtp packet: mno = 2 pno = 1 i summary, domain = test, rev = 11, followers = 0! This indicates that bing has received its! first summary advertisement. domain change notification sent transitioning from null to test domain! This is where bing gets the VTP domain name. summary packet rev 11 greater than domain test rev 0 domain test currently not in updating state summary packet with followers field zero FRAME 1 DLC: DLC Header DLC: DLC: Frame 1988 arrived at 15:01: ; frame size is 99 (0063 hex) bytes.

12 DLC: Destination = Multicast 01000CCCCCCC DLC: Source = Station BB63FD DLC: length = 85 DLC: LLC: LLC Header LLC: LLC: DSAP Address = AA, DSAP IG Bit = 00 (Individual Address) LLC: SSAP Address = AA, SSAP CR Bit = 00 (Command) LLC: Unnumbered frame: UI LLC: SNAP: SNAP Header SNAP: SNAP: Vendor ID = Cisco1 SNAP: Type = 2003 (VTP) SNAP: Cisco Virtual Trunk Protocol (VTP) Packet Version = 1 Message type = 0x01 (Summary Advert) Number of Subset Advert messages = 0 Length of management domain name = 4 Management domain name = "test" Number of Padding bytes = 28 Configuration revision number = 0x b Updater Identity IP address = Update Timestamp = " " MD5 Digest value = 0x F3015F0 0x220A A7A0 5. With trace set, bing receives a summary advertisement with no followers. Therefore, bing updates its domain name and sends advertisement requests to obtain the VLAN information (in FRAME 2 in this sample output):! On bing: tx vtp request, domain test, start value 0! This is where the advertisement request is sent. FRAME 2 DLC: DLC Header DLC: DLC: Frame 1683 arrived at 17:38: ; frame size is 60 (003C hex) bytes. DLC: Destination = Multicast 01000CCCCCCC DLC: Source = Station CFD DLC: length = 46 DLC: LLC: LLC Header LLC: LLC: DSAP Address = AA, DSAP IG Bit = 00 (Individual Address) LLC: SSAP Address = AA, SSAP CR Bit = 00 (Command) LLC: Unnumbered frame: UI LLC: SNAP: SNAP Header SNAP: SNAP: Vendor ID = Cisco1 SNAP: Type = 2003 (VTP) SNAP: Cisco Virtual Trunk Protocol (VTP) Packet Version = 1 Message type = 0x03 (Advert Request)

13 Reserved Length of management domain name = 4 Management domain name = "test" Padding bytes = 28 Start value = 0 (all VLANs) 6. Clic sends another summary advertisement (with field followers) to VLAN 1. This packet is followed by the subset advertisement that contains all VLANs (in FRAME 3 in this output). Then bing configures all the VLANs:! On bing: received vtp packet: mno = 2 pno = 1 i summary, domain = test, rev = 11, followers = 1! Bing has received its second summary advertisement. domain test, current rev = 0 found for summary pkt summary packet rev 11 greater than domain test rev 0! This configuration revision is higher than that on bing. domain test currently not in updating state received vtp packet: mno = 2 pno = 1 i subset, domain = test, rev = 11, seq = 1, length = 344! Bing has received its subset advertisement. domain test, current rev = 0 found for subset pkt domain change notification sent vlan 1 unknown tlv change notification sent vlan 2 unknown tlv change notification sent vtp_vlan_change_notification: vlan = 2, mode = 1 (ADD,ACTIVE), mno = 2 pno = 1 vlan = 2 vlan 3 unknown tlv change notification sent vtp_vlan_change_notification: vlan = 3, mode = 1 (ADD,ACTIVE), mno = 2 pno = 1 vlan = 3 vlan 4 unknown tlv change notification sent vtp_vlan_change_notification: vlan = 4, mode = 1 (ADD,ACTIVE), mno = 2 pno = 1 vlan = 4 vlan 5 unknown tlv change notification sent vtp_vlan_change_notification: vlan = 5, mode = 1 (ADD,ACTIVE), mno = 2 pno = 1 vlan = 5 vlan 6 unknown tlv change notification sent vtp_vlan_change_notification: vlan = 6, mode = 1 (ADD,ACTIVE), mno = 2 pno = 1 vlan = 6 vlan 7 unknown tlv change notification sent vtp_vlan_change_notification: vlan = 7, mode = 1 (ADD,ACTIVE), mno = 2 pno = 1 vlan = 7 FRAME 3 DLC: DLC Header DLC: DLC: Frame 2008 arrived at 15:01: ; frame size is 99 (0063 hex) bytes. DLC: Destination = Multicast 01000CCCCCCC DLC: Source = Station CFD DLC: length = 85 DLC: LLC: LLC Header LLC: LLC: DSAP Address = AA, DSAP IG Bit = 00 (Individual Address) LLC: SSAP Address = AA, SSAP CR Bit = 00 (Command)

14 LLC: Unnumbered frame: UI LLC: SNAP: SNAP Header SNAP: SNAP: Vendor ID = Cisco1 SNAP: Type = 2003 (VTP) SNAP: Cisco Virtual Trunk Protocol (VTP) Packet Version = 1 Message type = 0x01 (Summary Advert) Number of Subset Advert messages = 1! Here are the numbers. Length of management domain name = 4 Management domain name = "test" Number of Padding bytes = 28 Configuration revision number = 0x b Updater Identity IP address = Update Timestamp = " " MD5 Digest value = 0x F3015F0 0x220A A7A0 DLC: DLC Header DLC: DLC: Frame 2009 arrived at 15:01: ; frame size is 366 (016E hex) bytes DLC: Destination = Multicast 01000CCCCCCC DLC: Source = Station CFD DLC: length = 352 DLC: LLC: LLC Header LLC: LLC: DSAP Address = AA, DSAP IG Bit = 00 (Individual Address) LLC: SSAP Address = AA, SSAP CR Bit = 00 (Command) LLC: Unnumbered frame: UI LLC: SNAP: SNAP Header SNAP: SNAP: Vendor ID = Cisco1 SNAP: Type = 2003 (VTP) SNAP: Cisco Virtual Trunk Protocol (VTP) Packet Version = 1 Message type = 0x02 (Subset Advert) Sequence number = 1 Management Domain Name length = 4 Management Domain Name = "test" Number of Padding bytes = 28 Configuration revision number = 0x b VLAN Information Field # 1: VLAN information field length = 20 VLAN Status = 00 (Operational) VLAN type = 1 (Ethernet) Length of VLAN name = 7 ISL VLAN id = 1 MTU size = SAID field = VLAN Name = "default" # padding bytes in VLAN Name = 1 VLAN Information Field # 2:

15 VLAN information field length = 20 VLAN Status = 00 (Operational) VLAN type = 1 (Ethernet) Length of VLAN name = 8 ISL VLAN id = 2 MTU size = SAID field = VLAN Name = "VLAN0002" # padding bytes in VLAN Name = 0 VLAN Information Field # 3: VLAN information field length = 20 VLAN Status = 00 (Operational) VLAN type = 1 (Ethernet) Length of VLAN name = 8 ISL VLAN id = 3 MTU size = SAID field = VLAN Name = "VLAN0003" # padding bytes in VLAN Name = 0 VLAN Information Field # 4: VLAN information field length = 20 VLAN Status = 00 (Operational) VLAN type = 1 (Ethernet) Length of VLAN name = 8 ISL VLAN id = 4 MTU size = SAID field = VLAN Name = "VLAN0004" # padding bytes in VLAN Name = 0 VLAN Information Field # 5: VLAN information field length = 20 VLAN Status = 00 (Operational) VLAN type = 1 (Ethernet) Length of VLAN name = 8 ISL VLAN id = 5 MTU size = SAID field = VLAN Name = "VLAN0005" # padding bytes in VLAN Name = 0 VLAN Information Field # 6: VLAN information field length = 20 VLAN Status = 00 (Operational) VLAN type = 1 (Ethernet) Length of VLAN name = 8 ISL VLAN id = 6 MTU size = SAID field = VLAN Name = "VLAN0006" # padding bytes in VLAN Name = 0 VLAN Information Field # 7: VLAN information field length = 20 VLAN Status = 00 (Operational) VLAN type = 1 (Ethernet) Length of VLAN name = 8 ISL VLAN id = 7 MTU size = SAID field = VLAN Name = "VLAN0007" # padding bytes in VLAN Name = 0

16 VLAN Information Field # 8: VLAN information field length = 20 VLAN Status = 00 (Operational) VLAN type = 1 (Ethernet) Length of VLAN name = 8 ISL VLAN id = 10 MTU size = SAID field = VLAN Name = "VLAN0010" # padding bytes in VLAN Name = 0 VLAN Information Field # 9: VLAN information field length = 32 VLAN Status = 00 (Operational) VLAN type = 2 (FDDI) Length of VLAN name = 12 ISL VLAN id = 1002 MTU size = SAID field = VLAN Name = "fddi default" # padding bytes in VLAN Name = 0 Reserved 8 bytes VLAN Information Field # 10: VLAN information field length = 40 VLAN Status = 00 (Operational) VLAN type = 3 (Token Ring) Length of VLAN name = 18 ISL VLAN id = 1003 MTU size = SAID field = VLAN Name = "token ring default" # padding bytes in VLAN Name = 2 Reserved 8 bytes VLAN Information Field # 11: VLAN information field length = 36 VLAN Status = 00 (Operational) VLAN type = 4 (FDDI Net) Length of VLAN name = 15 ISL VLAN id = 1004 MTU size = SAID field = VLAN Name = "fddinet default" # padding bytes in VLAN Name = 1 Reserved 8 bytes VLAN Information Field # 12: VLAN information field length = 36 VLAN Status = 00 (Operational) VLAN type = 5 (TR Net) Length of VLAN name = 13 ISL VLAN id = 1005 MTU size = SAID field = VLAN Name = "trnet default" # padding bytes in VLAN Name = 3 Reserved 8 bytes 7. At this point, both switches are synchronized: bing (enable) show vtp domain

17 Domain Name Domain Index VTP Version Local Mode Password test 1 2 server Vlan count Max vlan storage Config Revision Notifications disabled Last Updater V2 Mode Pruning PruneEligible on Vlans disabled disabled bing (enable) show vlan VLAN Name Status IfIndex Mod/Ports, Vlans 1 default active 127 2/2 48 3/1 6 2 VLAN0002 active VLAN0003 active VLAN0004 active VLAN0005 active VLAN0006 active VLAN0007 active VLAN0010 active fddi default active token ring default active fddinet default active trnet default active 130 This example shows how to verify the VTP configuration on a Catalyst 6000 that runs Cisco IOS Software: Router#show vtp status VTP Version: 2 Configuration Revision: 247 Maximum VLANs supported locally: 1005 Number of existing VLANs: 33 VTP Operating Mode: Client VTP Domain Name: Lab_Network VTP Pruning Mode: Enabled VTP V2 Mode: Disabled VTP Traps Generation: Disabled MD5 digest: 0x45 0x52 0xB6 0xFD 0x63 0xC8 0x49 0x80 Configuration last modified by at :04:49 Router# This example shows how to display VTP statistics on a Catalyst 6000 that runs Cisco IOS Software: Router#show vtp counters VTP statistics: Summary advertisements received: 7 Subset advertisements received: 5 Request advertisements received: 0 Summary advertisements transmitted: 997 Subset advertisements transmitted: 13 Request advertisements transmitted: 3 Number of config revision errors: 0 Number of config digest errors: 0 Number of V1 summary errors: 0 VTP pruning statistics:

18 Trunk Join Transmitted Join Received Summary advts received from on pruning capable device Fa5/ VTP Troubleshooting and Caveats This section discusses some common troubleshooting situations for VTP. Unable to See VLAN Details in the show run Command Output Configuration changes in CatOS are written to NVRAM immediately after a change is made. In contrast, Cisco IOS Software does not save configuration changes to NVRAM unless you issue the copy running config startup config command. VTP client and server systems require VTP updates from other VTP servers to be immediately saved in NVRAM without user intervention. The VTP update requirements are met by the default CatOS operation, but the Cisco IOS update model requires an alternative update operation. For this alteration, a VLAN database was introduced into Cisco IOS Software as a method to immediately save VTP updates for VTP clients and servers. In some versions of software, this VLAN database is in the form of a separate file in NVRAM, called the vlan.dat file. You can view VTP/VLAN information that is stored in the vlan.dat file for the VTP client or VTP server if you issue the show vtp status command. VTP server/client mode switches do not save the entire VTP/VLAN configuration to the startup config file in the NVRAM when you issue the copy running config startup config command on these systems. This does not apply to systems that run as VTP transparent. VTP transparent systems save the entire VTP/VLAN configuration to the startup config file in NVRAM when you issue the copy running config startup config command. You can configure normal range VLANs (2 through 1000) when the switch is in either VTP server or transparent mode. But, you can only configure extended range VLANs (1025 through 4094) in VTP transparent switches. In order to display all the VLAN configurations (the VLAN ID, name, and so on) that are stored in the binary file, you must issue the show vlan command. You can display the VTP information (the mode, domain, and so on) with use of the show vtp status command. The VLAN information and the VTP information are not displayed in the show running config command output when the switch is in the VTP server/client mode. This is normal behavior of the switch. Router#show run include vlan vlan internal allocation policy ascending Router#show run include vtp Switches that are in VTP transparent mode display the VLAN and VTP configurations in the show running config command output because this information is also stored in the configuration text file. Router#show run include vlan vlan internal allocation policy ascending vlan 1 tb vlan tb vlan2 1003

19 vlan 20 21,50 51 vlan 1002 tb vlan1 1 tb vlan vlan 1003 tb vlan1 1 tb vlan vlan 1004 vlan 1005 Router#show run include vtp vtp domain cisco vtp mode transparent Catalyst Switches Do Not Exchange VTP Information VTP allows switches to advertise VLAN information between other members of the same VTP domain. VTP allows a consistent view of the switched network across all switches. There are several reasons why the VLAN information can fail to be exchanged. If switches that run VTP fail to exchange VLAN information, verify these items: VTP information only passes through a trunk port. Make sure that all ports that interconnect switches are configured as trunks and are actually trunking. Make sure that the VLANs are active in all the devices. One of the switches must be the VTP server in a VTP domain. All VLAN changes must be done on this switch in order to have them propagated to the VTP clients. The VTP domain name must match and it is case sensitive. "CISCO" and "cisco" are two different domain names. Make sure that no password is set between the server and client. If any password is set, make sure that the password is the same on both sides. Every switch in the VTP domain must use the same VTP version. VTP V1 and VTP V2 are not compatible on switches in the same VTP domain. Do not enable VTP V2 unless every switch in the VTP domain supports V2. Note: VTP V2 is disabled by default on VTP V2 capable switches. When you enable VTP V2 on a switch, every VTP V2 capable switch in the VTP domain enables V2. You can only configure the version on switches in VTP server or transparent mode. Switches that operate in transparent mode drop VTP advertisements if they are not in the same VTP domain. A switch that is in VTP transparent mode and uses VTP V2 propagates all VTP messages, regardless of the VTP domain that is listed. However, a switch with VTP V1 only propagates VTP messages that have the same VTP domain as the domain that is configured on the local switch. The extended range VLANs are not propagated. So you must configure extended range VLANs manually on each network device. Note: In the future, the Catalyst 6500 Cisco IOS Software switches will support VTP Version 3. This version is able to transmit extended range VLANs. So far, VTP Version 3 is only supported on CatOS. For more information on VTP Version 3, refer to the Understanding How VTP Version 3 Works section of Configuring VTP. The Security Association Identifier (SAID) values must be unique. SAID is a user configurable, 4 byte VLAN identifier. The SAID identifies traffic that belongs to a particular VLAN. The SAID also determines to which VLAN each packet is switched. The SAID value is 100,000 plus the VLAN number. Here are two examples:

20 The SAID for VLAN 8 is The SAID for VLAN 4050 is Only VTP servers can update the VTP client and server configurations. The VTP clients cannot update the VTP server or client configurations. However, the updates from the VTP server do not get updated on the client if the client already has a higher VTP revision number. Also, the client does not allow these updates to flow to its downstream VTP clients if the client has a higher revision number than the one that the VTP server sends. Catalyst Switch Automatically Changes VTP Mode from Client to Transparent Some Catalyst L2 and L3 fixed configuration switches change the VTP mode automatically from client to transparent with this error message: %SW_VLAN 6 VTP_MODE_CHANGE: VLAN manager changing device mode from CLIENT to TRANSPARENT. Either of these two reasons can cause the automatic VTP mode change in these switches: More VLANs run on the Spanning Tree Protocol (STP) than the switch can support. Catalyst L2 and L3 fixed configuration switches support a different maximum number of instances of STP with the use of per VLAN spanning tree+ (PVST+). For example, the Catalyst 2940 supports four instances of STP in PVST+ mode, while the Catalyst 3750 supports 128 instances of STP in PVST+ mode. If more than the maximum number of VLANs is defined in the VTP, the remaining VLANs operate with STP disabled. If the number of instances of STP that is already in use is greater than the maximum number, you can disable STP on one of the VLANs and enable it on the VLAN where you want STP to run. Issue the no spanning tree vlan vlan id global configuration command in order to disable STP on a specific VLAN. Then, issue the spanning tree vlan vlan id global configuration command to enable STP on the desired VLAN. Note: Switches that do not run STP still forward the bridge protocol data units (BPDUs) that they receive. In this way, the other switches on the VLAN that have a running STP instance can break loops. Therefore, STP must run on enough switches in order to break all the loops in the network. For example, at least one switch on each loop in the VLAN must run STP. You do not need to run STP on all switches in the VLAN. However, if you run STP only on a minimal set of switches, a change to the network can introduce a loop into the network and can result in a broadcast storm. Workarounds: Reduce the number of VLANs that are configured to a number that the switch supports. Configure the IEEE 802.1s Multiple STP (MSTP) on the switch in order to map multiple VLANs to a single STP instance. Use switches and/or images (Enhanced Image [EI]) which support a greater number of VLANs. The switch receives more VLANs from a connected switch than the switch can support. An automatic VTP mode change also can occur if the switch receives a VLAN configuration database message that contains more than a set number of VLANs. This normally happens in Catalyst L2 and L3 fixed configuration switches when they are connected to a VTP domain that has more VLANs

21 than are supported locally. Workarounds: In order to restrict the number of VLANs that are passed to the client switch, configure the allowed VLAN list on the trunk port of the connected switch. Enable pruning on the VTP server switch. Use switches and/or images (EI) which support a greater number of VLANs. CatOS Switch Changes to VTP Transparent Mode, VTP 4 UNSUPPORTEDCFGRCVD: A recent change in CatOS incorporated a protective feature that causes a CatOS switch to go into VTP transparent mode in order to prevent the possibility of a switch reset because of a watchdog timeout. This change is documented in these Cisco bug IDs: CSCdu32627 ( registered customers only) CSCdv77448 ( registered customers only) How Do I Determine If My Switch May Be Affected? The watchdog timeout can occur if these two conditions are met: The Token Ring VLAN (1003) is translated to VLAN 1. You make a change in VLAN 1. In order to observe the Token Ring VLAN translation, issue the show vlan command on the Catalyst. Here is example show vlan command output: VLAN Type SAID MTU Parent RingNo BrdgNo Stp BrdgMode Trans1 Trans2 1 enet How Does CatOS Version 6.3(3) Protect My Switch from a Watchdog Timeout? There is a protective feature to prevent a watchdog timeout in this CatOS version. The Catalyst switch switches from VTP server/client to VTP transparent mode. How Do I Determine If My Switch Has Gone to VTP Transparent Mode in Order to Protect Against a Watchdog Timeout? Your switch has gone to VTP transparent mode if the logging level for the VTP is raised to 4. Console> (enable) set logging level vtp 4 default You see this message when the switchover occurs: VTP 4 UNSUPPORTEDCFGRCVD:Rcvd VTP advert with unsupported vlan config on trunk mod/port VTP mode changed to transparent

22 What Are the Negative Effects When the Switch Goes to VTP Transparent Mode? 1. If pruning is enabled, the trunks go down. 2. If the trunks go down and no other ports are in that VLAN, the VLAN interface in the installed Multilayer Switch Feature Card (MSFC) goes down. If these effects occur, and this switch is in the core of your network, your network can be negatively affected. From Where Does the Unsupported VTP Configuration Come? Any Cisco IOS Software based switch, such as the switches in this list, can supply the unsupported VTP configuration: A Catalyst 2900/3500XL A Cisco IOS Software Catalyst 6500 A Cisco IOS Software based Catalyst 4000 These products translate the 1003 VLAN to VLAN 1 by default. What Is the Solution? The solution in CatOS based switches enables the switches to handle this translated information properly. The solution for the Cisco IOS Software based switches is to remove this default translation and match the behavior of the CatOS based switches. These are the integrated fixed versions that are currently available: CatOS switches Catalyst Switch Catalyst 4000 (Supervisor Engine III) Catalyst 6500 (Supervisor Engine Cisco IOS Software) Catalyst 2900 and 3500XL Fixed Releases 5.5(14) and later 6.3(6) and later 7.2(2) and later Not affected Cisco IOS Software Release 12.1(8a)EX and later Cisco IOS Software Release 12.0(5)WC3 and later If you cannot upgrade to images that have these fixes integrated, you can modify the configuration in the Cisco IOS Software based switches. Use this procedure (if the switch is a VTP server): goss#vlan data goss(vlan)#no vlan 1 tb vlan1 tb vlan2 Resetting translation bridge VLAN 1 to default Resetting translation bridge VLAN 2 to default goss(vlan)#no vlan 1003 tb vlan1 tb vlan2 Resetting translation bridge VLAN 1 to default Resetting translation bridge VLAN 2 to default

23 goss(vlan)#apply APPLY completed. goss(vlan)#exit APPLY completed. Exiting... The 1002 VLAN can be translated, but you can also remove it if you include this in your configuration: goss(vlan)#no vlan 1002 tb vlan1 tb vlan2 Resetting translation bridge VLAN 1 to default Resetting translation bridge VLAN 2 to default When Exactly Does My Switch Change to VTP Transparent Mode? Some confusion exists about when this switchover to VTP transparent mode occurs. The scenarios in this section provide examples of when the switchover can happen. Example 1 These are the initial conditions: Both the Catalyst 6500 and the Catalyst 3500XL are VTP servers with the same VTP configuration revision number. Both servers have the same VTP domain name and the same VTP password, if the password is configured. The Catalyst 3500XL has the translated Token Ring VLAN. You start the servers while they are disconnected. If you connect these two switches, the Catalyst 6500 goes to VTP transparent mode. Of course, this also happens if the Cisco 3500XL has a higher VTP configuration revision number than the Catalyst 6500 configuration revision number. Moreover, if the switch to VTP transparent mode happens when you physically connect the two switches, you can reasonably assume that the change would also happen if you booted the Catalyst 6500 for the first time while the switch was already connected. Example 2 These are the initial conditions: The Catalyst 6500 is a VTP server. The Catalyst 3500XL is a VTP client. The Catalyst 3500XL has a higher VTP configuration revision number than the Catalyst 6500 configuration revision number. Both switches have the same VTP domain and the same VTP password, if the password is configured. The Catalyst 3500XL has the translated Token Ring VLAN.

24 You start the servers while they are disconnected. If you connect these two switches, the Catalyst 6500 goes to VTP transparent mode. In this scenario, if the Catalyst 3500XL has a lower configuration revision number than the Catalyst 6500 configuration revision number, the Catalyst 6500 does not switch to VTP transparent mode. If the Catalyst 3500XL has the same configuration revision number, the Catalyst 6500 does not go to VTP transparent mode. But the translation is still present in the Catalyst 3500XL. What Is the Quickest Way to Recover After I Notice the Translation in My Network? Even if you correct the Token Ring VLAN information in one switch, such as the switch that malfunctioned, the information can have propagated throughout your network. You can use the show vlan command in order to determine if this occurred. Therefore, the quickest way to recover is to perform these steps: 1. Take a Cisco IOS Software based switch, such as a Catalyst XL that is connected to the network, and change the switch to a VTP server. 2. Remove the translated VLANs. 3. After you apply the change in the switch, reconnect the switch to the network. The change should be propagated to all the other VTP servers and clients. You can use the show vlan command in order to verify that the translation is gone in the network. At this point, you should be able to change the affected CatOS 6.3(3) switch back to a VTP server. Note: The Catalyst XL switches do not support as many VLANs as the Catalyst 6500s support. So take care to ensure that all the VLANs in the Catalyst 6500 exist in the Catalyst XL switch before you reconnect them. For example, you do not want to connect a Catalyst 3548XL with 254 VLANs and a higher VTP configuration revision number to a Catalyst 6500 that has 500 VLANs configured. How a Recently Inserted Switch Can Cause Network Problems Note: In order to see a Flash demonstration of this problem, see the Flash Animation: VTP section of this document. This problem occurs when you have a large switched domain that is all in the same VTP domain, and you want to add one switch in the network. This switch was previously used in the lab, and a good VTP domain name was entered. The switch was configured as a VTP client and was connected to the rest of the network. Then, you brought the ISL link up to the rest of the network. In just a few seconds, the whole network was down. What can have happened? The configuration revision number of the switch that you inserted was higher than the configuration revision number of the VTP domain. Therefore, your recently introduced switch, with almost no configured VLANs, erased all VLANs through the VTP domain. This happens whether the switch is a VTP client or a VTP server. A VTP client can erase VLAN information on a VTP server. You can tell that this has happened when many of the ports in your network go into inactive state but continue to be assigned to a nonexistent VLAN. Solution Quickly reconfigure all of the VLANs on one of the VTP servers.

25 What to Remember Always make sure that the configuration revision number of all switches that you insert into the VTP domain is lower than the configuration revision number of the switches that are already in the VTP domain. If you have the output of a show tech support command from your Cisco device, you can use the Output Interpreter ( registered customers only) in order to display potential issues and fixes. Example Follow these steps in order to see an example of this problem: Issue these commands in order to see that clic has 7 VLANs (1, 2, 3, and the defaults), clic is the VTP server in the domain named "test", and port 2/3 is in VLAN 3: clic (enable) show vlan 1993 May 25 05:09:50 %PAGP 5 PORTTOSTP:Port 2/1 joined bridge port 2/1 lan VLAN Name Status IfIndex Mod/Ports, Vlans 1 default active 65 2/2,2/ VLAN0002 active 70 3 VLAN0003 active 71 2/ fddi default active token ring default active fddinet default active trnet default active clic (enable) show vtp domain Domain Name Domain Index VTP Version Local Mode Password test 1 2 server Vlan count Max vlan storage Config Revision Notifications disabled Last Updater V2 Mode Pruning PruneEligible on Vlans disabled disabled clic (enable) show port 2/3 Port Name Status Vlan Level Duplex Speed Type 2/3 connected 3 normal 10 half 10/100BaseTX Connect bing, which is a lab switch on which VLANs 4, 5, and 6 were created. Note: The configuration revision number is 3 in this switch. bing (enable) show vlan VLAN Name Status IfIndex Mod/Ports, Vlans 1 default active 4 2/1 48 3/1 6 4 VLAN0004 active 63 5 VLAN0005 active 64 6 VLAN0006 active 65

26 fddi default active token ring default active fddinet default active trnet default active 7 Place bing in the same VTP domain ("test"). bing (enable) show vtp domain Domain Name Domain Index VTP Version Local Mode Password test 1 2 server Vlan count Max vlan storage Config Revision Notifications disabled Last Updater V2 Mode Pruning PruneEligible on Vlans disabled disabled Configure the trunk between the two switches in order to integrate bing in the network. Bing erased the clic VLAN, and now clic has VLANs 4, 5, and 6. However, clic no longer has VLANs 2 and 3, and port 2/3 is inactive. clic (enable) show vtp domain Domain Name Domain Index VTP Version Local Mode Password test 1 2 server Vlan count Max vlan storage Config Revision Notifications disabled Last Updater V2 Mode Pruning PruneEligible on Vlans disabled disabled clic (enable) clic (enable) show vlan VLAN Name Status IfIndex Mod/Ports, Vlans 1 default active 65 2/2,2/ VLAN0004 active 72 5 VLAN0005 active 73 6 VLAN0006 active fddi default active token ring default active fddinet default active trnet default active clic (enable) show port 2/3 Port Name Status Vlan Level Duplex Speed Type 2/3 inactive 3 normal auto auto 10/100BaseTX

27 Reset the Configuration Revision You can easily reset the configuration revision number. Replace the new domain name with the original domain name, as this procedure shows: 1. Issue this command in order to see that the configuration is empty: clic (enable) show vtp domain Domain Name Domain Index VTP Version Local Mode Password 1 2 server Vlan count Max vlan storage Config Revision Notifications disabled Last Updater V2 Mode Pruning PruneEligible on Vlans disabled disabled clic (enable) 2. Configure the domain name ("test", in this example) and create two VLANs. The configuration revision number goes up to 2: clic (enable) set vtp domain test VTP domain test modified clic (enable) set vlan 2 Vlan 2 configuration successful clic (enable) set vlan 3 Vlan 3 configuration successful clic (enable) show vtp domain Domain Name Domain Index VTP Version Local Mode Password test 1 2 server Vlan count Max vlan storage Config Revision Notifications disabled Last Updater V2 Mode Pruning PruneEligible on Vlans disabled disabled clic (enable) 3. Change the domain name from "test" to "cisco". The configuration revision number is back to 0, and all the VLANs are still present: clic (enable) set vtp domain cisco VTP domain cisco modified clic (enable) show vtp domain

28 Domain Name Domain Index VTP Version Local Mode Password cisco 1 2 server Vlan count Max vlan storage Config Revision Notifications disabled Last Updater V2 Mode Pruning PruneEligible on Vlans disabled disabled Change the VTP domain name from "cisco" back to "test". The configuration revision is 0. There is no risk that anything can be erased, and all the previously configured VLANs remain: clic (enable) set vtp domain test VTP domain test modified clic (enable) show vtp domain Domain Name Domain Index VTP Version Local Mode Password test 1 2 server Vlan count Max vlan storage Config Revision Notifications disabled Last Updater V2 Mode Pruning PruneEligible on Vlans disabled disabled clic (enable) All Ports Inactive After Power Cycle Switch ports move to the inactive state when they are members of VLANs that do not exist in the VLAN database. A common issue is that all the ports move to this inactive state after a power cycle. Generally, you see this when the switch is configured as a VTP client with the uplink trunk port on a VLAN other than VLAN 1. Because the switch is in VTP client mode, when the switch resets, it loses its VLAN database and causes the uplink port and any other ports that were not members of VLAN 1 to go into inactive mode. In order to solve this problem, complete these steps: 1. Temporarily change the VTP mode to transparent. 2. switch (enable) set vtp mode transparent VTP domain austinlab modified switch (enable) Add the VLAN to which the uplink port is assigned to the VLAN database. Note: This example assumes that VLAN 3 is the VLAN that is assigned to the uplink port. switch (enable) set vlan 3 VTP advertisements transmitting temporarily stopped, and will resume after the command finishes. Vlan 3 configuration successful