VTP Explained: Server, Client, Transparent, and the Revision-Number Outage

VTP (VLAN Trunking Protocol) is a Cisco-proprietary protocol that copies the VLAN database from one switch to every other switch in the same VTP domain over trunk links. A switch runs in server mode (can create and delete VLANs and originates advertisements), client mode (cannot edit VLANs and takes whatever it is told), or transparent mode (ignores what it hears and keeps a purely local database). Which database wins is decided by the configuration revision number, not by the mode, and that is the mechanism behind the classic VTP outage.

What VTP synchronizes

VTP carries VLAN identifiers, names, and state. It does not carry port assignments, trunk configuration, or anything about which interface belongs where. Adding VLAN 40 on a VTP server means every switch in the domain learns that VLAN 40 exists and is named whatever the server named it. Assigning ports to VLAN 40 is still per-switch work.

Three conditions must all hold before a switch accepts an advertisement. The link between the switches must be an operational trunk, since VTP advertisements travel only on trunks. The VTP domain name must match exactly, and it is case-sensitive. If a VTP password is configured, the passwords must match. A switch with a blank domain name adopts the first domain name it hears on a trunk, which is how a lab switch silently joins production.

VTP is Cisco’s own protocol and has no IEEE equivalent, so a third-party switch in the path neither participates nor relays. It is also routinely confused with DTP (Dynamic Trunking Protocol), which decides whether a link becomes a trunk in the first place and carries no VLAN information at all. The two are covered separately in DTP trunk negotiation.

The three modes

Behavior	Server	Client	Transparent
Create, rename, delete VLANs locally	Yes	No	Yes (local only)
Synchronizes its database from advertisements	Yes	Yes	No
Originates advertisements	Yes	Yes, relays and re-originates	No
Forwards advertisements out other trunks	Yes	Yes	Yes, within the same domain
Configuration revision number	Increments on change	Follows the domain	Stays 0
VLAN storage	vlan.dat	vlan.dat	vlan.dat and running configuration

Server is the default mode on a Catalyst switch. VTP version 3 adds a fourth mode, off, in which the switch neither participates nor forwards advertisements, and it also introduces a primary server role that must be claimed before VLAN edits are allowed, which exists specifically to stop accidental overwrites.

The revision number

Every VTP server and client stores a configuration revision number. Each VLAN addition, deletion, or rename on a server increments that number by one and triggers a new advertisement. When a switch receives an advertisement from its own domain carrying a revision number higher than the one it holds, it overwrites its entire local VLAN database with the contents of that advertisement, then adopts the new revision number.

Mode does not enter into that decision. A switch in client mode with revision 92 will overwrite a server sitting at revision 17. Client mode restricts what an engineer can type at the CLI; it does not restrict what the switch tells its neighbors. That asymmetry is what makes the failure so damaging: an engineer racks a switch pulled from a lab or a decommissioned site, plugs in the uplink, the uplink comes up as a trunk, the domain name happens to match, and the used switch advertises a stale database with a large revision number. Production VLANs that are absent from that stale database are deleted domain-wide within seconds. Access ports assigned to the deleted VLANs go inactive, and the outage covers every switch that heard the advertisement.

Erasing the startup configuration does not protect you. The revision number and the VLAN database live in flash:vlan.dat, not in NVRAM (non-volatile RAM), so write erase and reload leave both intact.

Safe procedure for introducing a used switch

Reset the revision number to 0 before the switch ever sees a production trunk. Any one of these resets it, and doing more than one is cheap insurance:

• Set the mode to transparent, which forces the revision to 0: SW9(config)# vtp mode transparent
• Change the VTP domain name to a throwaway value, which also forces the revision to 0: SW9(config)# vtp domain SCRATCH
• Delete the database file and erase the configuration: delete flash:vlan.dat, then write erase, then reload.

Confirm before connecting anything:

SW9# show vtp status
VTP Version capable             : 1 to 3
VTP version running             : 1
VTP Domain Name                 : SCRATCH
VTP Pruning Mode                : Disabled
VTP Traps Generation            : Disabled

Feature VLAN:
--------------
VTP Operating Mode                : Transparent
Maximum VLANs supported locally   : 1005
Number of existing VLANs          : 5
Configuration Revision            : 0

Configuration Revision : 0 is the line that matters. Only after that reading is confirmed should the switch be given the production domain name and its intended mode. Many enterprises skip the risk entirely by running every switch in transparent mode or VTP off and managing VLANs through configuration templates.

Version differences and pruning

VTP version 1 and version 2 advertise only normal-range VLANs, so VLAN IDs 1006 through 4094 cannot be propagated and require transparent mode to configure at all. Version 3 advertises the extended range and can also carry MST (Multiple Spanning Tree) and private VLAN information.

VTP pruning is a separate feature enabled on a server with vtp pruning. It stops a switch from flooding traffic for a VLAN down a trunk when no switch on the far side has an active port in that VLAN, which conserves trunk bandwidth. Pruning is dynamic and reversible; it is not the same thing as the statically configured allowed VLAN list described in 802.1Q trunking, and the two lists appear as separate rows in show interfaces trunk output.

Verification and the commands it is confused with

show vtp status answers domain, version, operating mode, revision number, and total VLAN count. It says nothing about which ports belong to which VLAN. That per-VLAN, per-port table is show vlan brief, the condensed listing with VLAN, Name, Status, and Ports columns. Two other commands get offered as decoys: show interfaces trunk reports only ports that are currently trunking along with their allowed and active VLAN lists, and show interfaces switchport dumps exhaustive per-port switching detail for every interface without organizing anything by VLAN.

How the 200-301 exam tests this

• The overwrite scenario. A previously used switch is added, VLANs disappear across the campus, and you must name the cause. The answer names the higher configuration revision number, and the accompanying fix is resetting it to 0 before connecting the switch.
• Mode capability. A question asks which mode allows local VLAN creation without affecting neighbors. Transparent is the answer, because server also propagates and client cannot create at all.
• Command selection. You are asked which command shows every VLAN with its name, status, and assigned access ports in one table. show vtp status is the tempting wrong answer; show vlan brief is correct.
• VTP versus DTP. A question describes advertising the VLAN database between switches and offers both protocols. VTP distributes VLANs, DTP negotiates trunks.

The overwrite scenario shows up in some form on nearly every attempt — exam-style questions make the revision-number logic hard to forget.

Quick reference

• VTP is Cisco-proprietary, runs only over operational trunks, and requires a matching case-sensitive domain name.
• Server creates and advertises, client synchronizes and relays, transparent ignores advertisements but forwards them within the domain.
• The highest configuration revision number wins regardless of mode, so a client can overwrite a server.
• Transparent mode and a domain name change both force the revision number to 0.
• write erase does not clear VTP state; the database and revision live in flash:vlan.dat.
• Versions 1 and 2 handle only VLANs 1 to 1005; version 3 adds the extended range, a primary server role, and an off mode.
• Confirm Configuration Revision : 0 with show vtp status before trunking a used switch into production.