Layer 2 connect between different VTP Domains

[ROLAND MARTI]

Hi

i would like to connect between two different VTP Domains.

If i look on the port show trunk i become the following fault message :

* - indicates vtp domain mismatch

Port Mode Encapsulation Status Native vlan

-------- ----------- ------------- ------------ -----------

2/5 on dot1q trunking* 1

Can anybody say me, how i can stop vtp information on this port.

Thanks Roland

[milan.kulik]

Hi,

you can't stop sending VTP just on one port.

The only way is to disable VLAN1 on the trunk which is a little dangerous - no other Cisco protocol will be sent on VLAN1 (CDP, PaGP, CMP, etc.), Common STP tree will be disrupted, etc.

Even set VTP mode to transparent wouldn't help, I'm afraid.

Regards,

Milan

[ROLAND MARTI]

Hi Milan

thanks for your idea, but i have'nt allowed vlan 1 on this trunk (i used clear trunk) and i have always this fault.

This command is configured both side on the trunk.

clear trunk 2/5 1-200,202-930,932-1005,1025-4094

set trunk 2/5 on dot1q 201,931

Regards,

Roland

[milan.kulik]

Interesting...

Are you sure VLAN1 is not running on your trunk?

Some older CatOS versions disabled VLAN1 only for user data but remained for service protocols (VTP, CDP,...).

Which CatOS version are you running on both line ends?

When you issue sh trunk and sh spantree for 2/5 do you see VLAN1 disabled on both line ends?

Is 2/5 the only trunk between these two domains? Maybe the VTP info is sent via another path?

Regards,

Milan

[ROLAND MARTI]

Hi Milan

thank for your interest.

Here any more information.

WS-C6509 Software, Version NmpSW: 6.3(4)

switch> (enable) sh port trunk 2/5

* - indicates vtp domain mismatch

Port Mode Encapsulation Status Native vlan

-------- ----------- ------------- ------------ -----------

2/5 on dot1q trunking* 1

Port Vlans allowed on trunk

-------- ---------------------------------------------------------------------

2/5 201,931

Port Vlans allowed and active in management domain

-------- ---------------------------------------------------------------------

2/5 201,931

Port Vlans in spanning tree forwarding state and not pruned

-------- ---------------------------------------------------------------------

2/5 201,931

We have two parallel path with the same configuration.

Do you think the nativ Vlan 1 is online without trunk connect?

Thanks Roland

[milan.kulik]

Hi Roland,

I've found my notes from my lab tests a year ago.

The conclusion is: It's impossible to disable VTP frames on trunk.

Even if you change native VLAN to be different from VLAN1 and disable VLAN1 on the trunk the VTP frames are still sent (tagged as VLAN1).

Sorry for confusing - the tests were STP oriented and I mixed VTP and STP in my mind.

So the only possibility I see would be upgrade to CatOS 7 and set VTP mode off. VTP frames should not be sent at all in this mode (I haven't tested).

But I'm afraid you can't do this - you probably need VTP on your 6509.

Regards,

Milan

[konigl]

Roland,

Currently you cannot stop VTP information on a trunk port. That information goes out on VLAN 1, which is one of the default VLANs ineligible for pruning.

When you have a trunk connection between two VTP domains, the border switches in each domain just ignore VTP announcements from the other domain. So if you have a trunk port that's showing a VTP domain mismatch, that's just the switch's way of telling you it's a border switch.

If you want to make sure no one can connect to your border switch and make changes to VLANs in one of the domains, you can associate a password with the domain. Then if announcements in the same domain don't share the same password the information gets dropped.

If you want to completely eliminate the mismatch on the connection between VTP domains, the only way I can think of is to make that link a non-trunking Layer 3 connection instead.

Hope this helps.

[ROLAND MARTI]

hi

thanks for information.

But

i have two buildings with serverfarms, i need one layer 2 connect for the cluster between the two buildings. So it isn't possible to make only layer 3 connects.

Regards Roland