When Manually Configuring a Port As Access, DTP Will Be Automatically Disabled. So Why Is It When Configuring a Port As Trunk, DTP Will Still Be Enabled?
The DTP is used by Cisco switches to negotiate whether an interconnection between two switches should be put into access or trunk mode. It is meant both to ease the initial deployment of a switched network and to minimize configuration errors that result from mismatched port configuration on an interconnection between two switches.
The DTP helps to automatically negotiate whether the port should be put into access or trunk mode and what trunking protocol (802.1Q or ISL) should be used. The individual DTP modes are:
DTP datagrams are also sent if the port is set statically to the trunk mode. However, if the port is set statically to the access mode, both sending and processing DTP datagrams on that port is deactivated.
The individual combinations of port settings lead to following results:
As you can see, if both ports are dynamic auto, they will act as access ports. If either of them is dynamic desirable, both will agree on trunking. If one of them is dynamic and the other is static, the mode is dictated by the statically set port.
The DTP protocol is unauthicated which means that a station can send false DTP packets, pretending to be a switch. If the switchport is configured as a dynamic port, an attacker can lure the switchport to become a trunk port and he will gain access to all VLANs allowed on that trunk. Therefore, after a network has been installed, it is the best practice to set the mode statically and deactivate the DTP protocol on a port using the command switchport nonegotiate (this command is necessary only for trunk ports, as the static access ports do not send DTP packets automatically).
more information: https://community.cisco.com/t5/switching/why-dtp-is-used/td-p/1377495
@Seb Rupik lol, i forgot it, thanks.
Thank You For Your Response, But My Question Is Why a Port That Is Configured Statically As Trunk Doesn't Automatically Disable DTP Like Access Ports Do
@Jaderson Pessoa You really should credit and reference the original post!:
Hi @Ali Hazim ,
In short, DTP manages the link that connects two switches to become a trunk link, even without previous configurations.
The only instance in which the link will be deactivated, is when in a link, one side is configured as a trunk and the other side as access.
As mentioned @Jaderson Pessoa , it is a good practice to disable DTP, since being a Cisco exclusive protocol, it can cause problems with other brands.
Remember to mark the correct answers as solved, because that helps other users with similar doubts.
just like to add - i always choose to make not only trunks but also access mode ports non negotiate which inst necessary on a access mode port but I like to make sure dtp isn’t active in anyway and to prevent the access port accidentally being changed in anyway and then left as a dynamic desirable.