DTP Modes: Which Combinations Actually Form a Trunk

DTP (Dynamic Trunking Protocol) is a Cisco-proprietary protocol that lets two switch ports decide between operating as a trunk or as an access link. A trunk forms only when at least one end actively initiates negotiation and the other end is willing to accept. dynamic desirable initiates, dynamic auto accepts without ever asking, a statically configured trunk initiates by default, and a statically configured access port neither asks nor answers. Two passive ends therefore produce an access link, which is the single most tested outcome in this topic.

The four administrative modes

• switchport mode access fixes the port as an access port and disables DTP on it. The port cannot be talked into trunking by any neighbor.
• switchport mode trunk fixes the port as a trunk. It has no fallback logic, so it keeps tagging whether or not the far end cooperates, and it continues to emit DTP frames unless they are explicitly silenced.
• switchport mode dynamic auto is passive. The port will agree to trunk if invited but never issues an invitation.
• switchport mode dynamic desirable is active. The port issues invitations and accepts them.

Both dynamic settings leave DTP running. switchport nonegotiate silences DTP on a port, and IOS accepts it only when the administrative mode is statically set to access or trunk. Applied to a port sitting in dynamic desirable or dynamic auto, the command is rejected with a conflict message and nothing is stored, because a port whose role is defined by negotiation cannot reach a decision with negotiation turned off.

The out-of-box administrative mode is a dynamic one and varies by platform, with dynamic auto common on current Catalyst switches. Two factory-default switches cabled together therefore tend to sit as an access link in VLAN 1 rather than as a trunk.

The mode matrix

Local port	Neighbor port	Result
dynamic auto	dynamic auto	Access link, nobody initiates
dynamic auto	dynamic desirable	Trunk
dynamic desirable	dynamic desirable	Trunk
dynamic auto	trunk	Trunk, the static end initiates
dynamic desirable	trunk	Trunk
dynamic desirable	access	Access link
access	access	Access link
access	trunk	Broken, one end tags and the other discards tags
trunk with nonegotiate	dynamic auto	Broken, no invitation is ever sent
trunk with nonegotiate	trunk	Trunk

Two rows deserve attention because they fail without taking the link down.

Static trunk facing static access. Neither setting yields to the other, since both are fixed. The trunking side tags everything except its native VLAN, and the access side discards frames carrying a tag it does not expect. Only the untagged native VLAN frames survive the crossing, and they land in whatever access VLAN the far port is assigned. Cisco explicitly advises against pairing these two. The link stays up and forwarding, so link state gives no hint.

Static trunk with negotiation suppressed facing a passive neighbor. Suppressing DTP removes the only signal a dynamic auto port can respond to, so the passive end concludes it is an access port while the static end keeps trunking. Adding switchport nonegotiate to one end of a link and not the other reproduces this every time. Configure both ends of a planned uplink as static trunks before silencing negotiation on either.

Verification

SW1# show interfaces gigabitethernet 1/0/2 switchport
Name: Gi1/0/2
Switchport: Enabled
Administrative Mode: dynamic auto
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Voice VLAN: none

Read the lines in pairs. Administrative Mode is what was configured; Operational Mode is what the port actually became. Those two disagreeing is the entire diagnosis on a link that failed to trunk. Negotiation of Trunking reads On or Off and is the only line that answers whether the port is emitting DTP frames, which is what an audit of a hardened uplink is looking for. A port set statically to trunk still shows On until switchport nonegotiate is applied, so the administrative mode alone never settles that question. Operational Trunking Encapsulation describes framing rather than negotiation, and native there means the port is not tagging at all.

Reading show interfaces trunk contributes a second angle. Its Mode column reports the local administrative setting as on, off, auto, desirable, or nonegotiate, and its Status column reports the outcome. A row reading auto in Mode and trunking in Status proves something about the neighbor: since a passive port never initiates, the far end must have initiated, which narrows it to dynamic desirable or a statically configured trunk that still has DTP enabled. The full breakdown of that output is in 802.1Q trunking.

Symptoms of two passive ends

A link where both switches sit in dynamic auto settles as an access link in the default access VLAN, and three symptoms appear together. Only VLAN 1 traffic crosses. show interfaces trunk returns nothing on either switch, because it lists operational trunks only. No native VLAN mismatch is logged, because CDP (Cisco Discovery Protocol) compares native VLANs only across a trunk and there is no trunk to compare. Any switchport trunk native vlan or switchport trunk allowed vlan commands sit inert, applying to a trunk that never formed. Setting at least one end to a mode that initiates resolves all of it.

Security and the hard-set standard

DTP is why switch spoofing works. A host running software that emits DTP frames can negotiate a trunk with a port left in a dynamic mode, and the moment it does, it receives traffic for every VLAN the trunk permits. Two configuration habits close the path. On every user-facing port, switchport mode access disables DTP and makes the outcome deterministic regardless of what the attached device sends. On every planned switch-to-switch uplink, set both ends statically to trunk and add switchport nonegotiate.

The benefits of that standard are specific: the link’s role no longer depends on a neighbor whose configuration may change without notice, and the spoofing path is removed. It does not accelerate spanning-tree convergence, which is governed by protocol timers and features such as PortFast. It does not affect whether extended-range VLANs cross the link, since the tag format is unchanged, and it does not prune the permitted VLAN list, which stays hand-maintained.

DTP being Cisco-proprietary has two consequences worth carrying into the exam: a link to a third-party switch will never negotiate and must be hard-set on the Cisco side, and no IEEE document describes this behavior. 802.1Q defines the tag format and the native VLAN concept, not dynamic negotiation. Distributing the VLAN database between switches is a different Cisco protocol entirely; see VTP modes.

How the 200-301 exam tests this

• Predict the outcome. Two administrative modes are given and you state whether the link trunks. Anchor on the rule that one end must initiate.
• Fix without touching one switch. A capture shows one port in dynamic auto with negotiation on, and the constraint forbids changing that switch. The single change on the neighbor is dynamic desirable, since auto leaves both passive and nonegotiate removes the last chance.
• Command legality. switchport nonegotiate is offered against a port in a dynamic mode. It is rejected, not deferred and not applied.
• Inference from output. A trunk row showing auto mode and trunking status asks what the neighbor must be. Two answers qualify, and both of them initiate.
• Justify a standard. Asked why uplinks are hard-set with negotiation off, the correct picks are deterministic behavior and elimination of switch spoofing.

The mode-pairing matrix looks simple until a stem buries it inside output — drill it with practice questions until the initiator rule is automatic.

Quick reference

• A trunk needs one initiator: dynamic desirable or a static trunk with DTP still enabled.
• dynamic auto on both ends produces an access link in the default VLAN.
• switchport mode access disables DTP; switchport mode trunk does not.
• switchport nonegotiate is legal only on a statically set access or trunk port and is rejected on a dynamic mode.
• Static trunk facing static access forwards only untagged native VLAN frames and drops the rest.
• Negotiation of Trunking: Off in show interfaces <interface> switchport confirms DTP is silenced.
• DTP is Cisco-proprietary and never negotiates with a third-party switch.
• Leaving user ports in a dynamic mode enables switch spoofing and reach into every allowed VLAN.