Showing results for 
Search instead for 
Did you mean: 

DTP On Trunk Ports

When Manually Configuring a Port As Access, DTP Will Be Automatically Disabled. So Why Is It When Configuring a Port As Trunk, DTP Will Still Be Enabled?

VIP Collaborator

The DTP is used by Cisco switches to negotiate whether an interconnection between two switches should be put into access or trunk mode. It is meant both to ease the initial deployment of a switched network and to minimize configuration errors that result from mismatched port configuration on an interconnection between two switches.


The DTP helps to automatically negotiate whether the port should be put into access or trunk mode and what trunking protocol (802.1Q or ISL) should be used. The individual DTP modes are:


  • dynamic auto - the port will negotiate the mode automatically, however, it prefers to be an access port
  • dynamic desirable - the port will negotiate the mode automatically, however, it prefers to be a trunk port


DTP datagrams are also sent if the port is set statically to the trunk mode. However, if the port is set statically to the access mode, both sending and processing DTP datagrams on that port is deactivated.


The individual combinations of port settings lead to following results:


  • dynamic auto + dynamic auto = access
  • dynamic auto + dynamic desirable = trunk
  • dynamic desirable + dynamic desirable = trunk
  • dynamic auto or dynamic desirable + trunk = trunk
  • dynamic auto or dynamic desirable + access = access


As you can see, if both ports are dynamic auto, they will act as access ports. If either of them is dynamic desirable, both will agree on trunking. If one of them is dynamic and the other is static, the mode is dictated by the statically set port.


The DTP protocol is unauthicated which means that a station can send false DTP packets, pretending to be a switch. If the switchport is configured as a dynamic port, an attacker can lure the switchport to become a trunk port and he will gain access to all VLANs allowed on that trunk. Therefore, after a network has been installed, it is the best practice to set the mode statically and deactivate the DTP protocol on a port using the command switchport nonegotiate (this command is necessary only for trunk ports, as the static access ports do not send DTP packets automatically).


more information:


@Seb Rupik lol, i forgot it, thanks.

Jaderson Pessoa
*** Rate All Helpful Responses ***

Thank You For Your Response, But My Question Is Why a Port That Is Configured Statically As Trunk Doesn't Automatically Disable DTP Like Access Ports Do


@Jaderson Pessoa You really should credit and reference the original post!:

VIP Advisor

Hi @Ali Hazim ,


In short, DTP manages the link that connects two switches to become a trunk link, even without previous configurations.
The only instance in which the link will be deactivated, is when in a link, one side is configured as a trunk and the other side as access.

As mentioned @Jaderson Pessoa , it is a good practice to disable DTP, since being a Cisco exclusive protocol, it can cause problems with other brands.


Remember to mark the correct answers as solved, because that helps other users with similar doubts.



VIP Mentor


just like to add - i always choose to make not only trunks but also access mode ports non negotiate which inst necessary on a access mode port but I like to make sure dtp isn’t active in anyway and to prevent the access port accidentally being changed in anyway and then left as a dynamic desirable.

kind regards

Please rate and mark posts accordingly if you have found any of the information provided useful.
It will hopefully assist others with similar issues in the future
Content for Community-Ad