📘 Who is this guide for?
This article is for beginner and junior network engineers who already know the basic
switchport mode access and switchport mode trunk commands, but never really paid
attention to something called DTP (Dynamic Trunking Protocol).
If you've ever configured a trunk, the link somehow "just worked" and you moved on — this guide will show you what actually happened in the background, and how a small default setting can become a security risk.
1️⃣ Quick recap: Access vs Trunk ports
Before we touch DTP, let's make sure the basics are clear:
- Access Port – Carries traffic for only one VLAN. Used for end devices like PCs, IP phones, printers.
- Trunk Port – Carries traffic for multiple VLANs using tagging (802.1Q). Used between switches, or switch to router (router-on-a-stick).
Typical configs:
interface FastEthernet0/1 switchport mode access switchport access vlan 10 interface FastEthernet0/24 switchport trunk encapsulation dot1q <-- (older IOS) switchport mode trunk switchport trunk allowed vlan 10,20,30
If it's going to a PC, it should almost always be an access port.
2️⃣ What is DTP (Dynamic Trunking Protocol)?
DTP – Dynamic Trunking Protocol is a Cisco proprietary protocol that allows switch ports to negotiate with each other and decide:
- Should this link become a trunk?
- Or stay as an access link?
So instead of you manually typing switchport mode trunk on both sides, DTP can auto-decide it based
on the mode you set.
3️⃣ When does DTP actually work?
DTP only runs when the port is in a dynamic or trunk-capable mode, such as:
switchport mode dynamic desirable switchport mode dynamic auto switchport mode trunk
When such a port connects to another switch, it starts sending DTP frames to say: "Hey, do you want to form a trunk with me?" 🤝
4️⃣ DTP port modes – Simple explanation
On a Cisco switch, the important switchport modes related to DTP are:
- access – Force access, no DTP negotiation
- trunk – Force trunk, and by default still sends DTP
- dynamic desirable – Actively tries to form a trunk (sends DTP)
- dynamic auto – Waits passively, agrees to trunk if asked
Desirable vs Auto – who starts the conversation?
- dynamic desirable – "I want a trunk. I will send DTP messages first."
- dynamic auto – "I'm quiet. If someone asks me to be a trunk, I will accept."
Important rule:
- ✅ Desirable + Desirable → Trunk will form
- ✅ Desirable + Auto → Trunk will form
- ❌ Auto + Auto → No trunk (both are waiting, nobody talks)
interface f0/1 switchport mode dynamic desirable interface f0/2 switchport mode dynamic auto ! Result: Trunk forms (desirable initiates)
5️⃣ Why do many engineers ignore DTP?
In many labs and small networks, engineers simply configure:
switchport mode trunk
The link comes up as trunk, everything works, and they move on. But in the background, DTP may still be active and sending frames unless you tell the switch:
switchport nonegotiate
Ignoring DTP is okay in a small lab, but in a production environment it can become a serious security risk.
6️⃣ Security risk: DTP spoofing attack (concept)
Imagine you have an access port going to a user PC. You think: "It's only VLAN 10. No problem."
But if that port is misconfigured (for example left in dynamic auto), and an attacker connects a device that speaks DTP, they can pretend to be a switch and try to negotiate a trunk.
Once the port becomes a trunk, the attacker's device can:
- See traffic from multiple VLANs (depending on allowed VLANs).
- Perform VLAN hopping and sniff sensitive traffic.
- Bypass normal access VLAN isolation.
7️⃣ Best practice: Be explicit, not "dynamic"
The safest rule to remember:
- End-user / PC / printer ports → Force access, disable DTP
- Switch-to-switch / switch-to-router links → Force trunk, disable DTP
Secure Access Port Template
interface FastEthernet0/10 description User-PC switchport mode access switchport access vlan 10 switchport nonegotiate spanning-tree portfast spanning-tree bpduguard enable
Here, switchport nonegotiate guarantees that DTP frames will not be sent from this port.
It will never try to become a trunk.
Secure Trunk Port Template
interface GigabitEthernet0/1 description Uplink-to-Core-Switch switchport trunk encapsulation dot1q ! (if required by IOS) switchport mode trunk switchport trunk allowed vlan 10,20,30 switchport nonegotiate
You are manually forcing the port as a trunk and explicitly defining which VLANs are allowed. DTP is disabled, so no one else can negotiate anything unexpected.
8️⃣ Useful DTP show command
Cisco provides a handy command to check the DTP status on an interface:
Sw# show dtp interface DTP information for Gig0/1: TDN capable: Yes DTP state: Sending, Negotiating Operational Mode: trunk ...
This helps confirm whether your port is still participating in DTP negotiation or not.
9️⃣ Step-by-step lab: See DTP in action
You can try this in a simple lab with two Cisco switches:
Step 1 – Default dynamic behavior
SW1(config)# interface f0/1 SW1(config-if)# switchport mode dynamic desirable SW2(config)# interface f0/1 SW2(config-if)# switchport mode dynamic auto
After connecting these interfaces with a cable, check:
SW1# show interfaces trunk
You should see a trunk formed between SW1 and SW2.
Step 2 – Break the trunk using Auto + Auto
SW1(config)# interface f0/1 SW1(config-if)# switchport mode dynamic auto SW2(config)# interface f0/1 SW2(config-if)# switchport mode dynamic auto
Now, check again:
SW1# show interfaces trunk ! <-- no trunk should appear
Step 3 – Force trunk and disable DTP
SW1(config)# interface f0/1 SW1(config-if)# switchport mode trunk SW1(config-if)# switchport nonegotiate SW2(config)# interface f0/1 SW2(config-if)# switchport mode trunk SW2(config-if)# switchport nonegotiate
Now the trunk is fully manual, no dynamic negotiation.
🔟 Key takeaways (short summary)
- DTP is a Cisco protocol that negotiates trunking between switch ports.
- dynamic desirable sends DTP actively, dynamic auto waits quietly.
- Auto + Auto = No trunk (both are waiting).
- Leaving DTP on end-user ports can create a serious security risk.
- Best practice: Use switchport mode access + switchport nonegotiate on user ports.
- On uplinks, manually configure trunks and also use switchport nonegotiate if possible.
- Use show dtp interface and show interfaces trunk to verify behavior.
Your network security often starts with what looks like "just a small switchport command". Understanding DTP makes you the kind of engineer who doesn't just copy-paste configs — you actually know what's happening behind the scenes 🔐
💬 Leave a Comment