Cisco IE 4000, Software Configuration Manual

Page: 303 / 1066

299
Configuring VTP
Information About Configuring VTP

Version-Dependent Transparent Mode—In VTP version 1, a VTP transparent switch inspects VTP messages for the
domain name and version and forwards a message only if the version and domain name match. Although VTP version
2 supports only one domain, a VTP version 2 transparent switch forwards a message only when the domain name
matches.

Consistency Checks—In VTP version 2, VLAN consistency checks (such as VLAN names and values) are performed
only when you enter new information through the CLI or SNMP. Consistency checks are not performed when new
information is obtained from a VTP message or when information is read from NVRAM. If the MD5 digest on a
received VTP message is correct, its information is accepted.
VTP Version 3
VTP version 3 supports these features that are not supported in version 1 or version 2:

Enhanced authentication—You can configure the authentication as hidden or secret . When hidden , the secret key
from the password string is saved in the VLAN database file, but it does not appear in plain text in the configuration.
Instead, the key associated with the password is saved in hexadecimal format in the running configuration. You must
reenter the password if you enter a takeover command in the domain. When you enter the
secret keyword, you can
directly configure the password secret key.

Support for extended range VLAN (VLANs 1006 to 4096) database propagation. VTP versions 1 and 2 propagate
only VLANs 1 to 1005. If extended VLANs are configured, you cannot convert from VTP version 3 to version 1 or 2.
VTP pruning still applies only to VLANs 1 to 1005, and VLANs 1002 to 1005 are still reserved and cannot be
modified.

Support for any database in a domain. In addition to propagating VTP information, version 3 can propagate Multiple
Spanning Tree (MST) protocol database information. A separate instance of the VTP protocol runs for each
application that uses VTP.

VTP primary server and VTP secondary servers. A VTP primary server updates the database information and sends
updates that are honored by all devices in the system. A VTP secondary server can only back up the updated VTP
configurations received from the primary server to its NVRAM.
By default, all devices come up as secondary servers. You can enter the vtp primary privileged EXEC command to
specify a primary server. Primary server status is only needed for database updates when the administrator issues
a takeover message in the domain. You can have a working VTP domain without any primary servers. Primary server
status is lost if the device reloads or domain parameters change, even when a password is configured on the switch.

The option to turn VTP on or off on a per-trunk (per-port) basis. You can enable or disable VTP per port by entering
the [
no ] vtp interface configuration command. When you disable VTP on trunking ports, all VTP instances for that
port are disabled. You cannot set VTP to off for the MST database and on for the VLAN database on the same port.
When you globally set VTP mode to off, it applies to all the trunking ports in the system. However, you can specify
on or off on a per-VTP instance basis. For example, you can configure the switch as a VTP server for the VLAN
database but with VTP
off for the MST database.
VTP Version Guidelines
Follow these guidelines when deciding which VTP version to implement:

All switches in a VTP domain must have the same domain name, but they do not need to run the same VTP version.

A VTP version 2-capable switch can operate in the same VTP domain as a switch running VTP version 1 if version
2 is disabled on the version 2-capable switch (version 2 is disabled by default).

If a switch running VTP version 1 but capable of running VTP version 2 receives VTP version 3 advertisements, it
automatically moves to VTP version 2.