VTP switching from v1 to v3

[patoberli]

Hello all

I have a medium sized network with around 100 switches, mixed Catalyst and Nexus models. All are fairly new and all support VTPv3. The new Nexus are in transparent mode (as Client isn't anymore supported), all the other switches are client. A domain and a password is already set and currently the VTP domain is version 1. 

If I switch this to version 3 (on a Catalyst 9500 running 16.12.x) on the current server and set it to primary, will this cause any outage or issue with all the switches? I need this, as I need VLANs > 1024, which the Cat 9500 isn't permitting to do:

Jul 21 2021 14:40:18.862 CEST: %SW_VLAN-4-VLAN_CREATE_FAIL: Failed to create VLANs 1085: extended VLAN(s) not allowed in current VTP mode

Thanks

Patrick

[balaji.bandi · Accepted solution]

I do not see any issue changing from VTP v3, make sure you change on client side too.

VLAN DB sitll hold the same information while upgrading to v3

what spanning tree you running MST ?

if you are caution of implement, do it in maintenance window.

[patoberli]

Thanks for the answer. 

Running Rapid PVST, no MST. Currently we have about 110 VLANs. 

[Manoj Reddy · Accepted solution]

Hi @patoberli 

VTP versions nothing has to do with the VLAN Database, it's just for securing VTP V3 is required rather than V1, until unless you have vlam.dat file exists in your flash you're in safe hands.

I think you can change to VTP V3 without any problems, are as@balaji.bandi suggested go for a change downtime interval and try to implement in 1 or 2 switches, also if you want to use the extended VLANs the mode should be set to transparent, but i recommend if you are chaning the VTP versions pls change on both the switch sides instead of one side @balaji.bandi  let me know your thoughts?

[Giuseppe Larosa · Accepted solution]

Hello @Manoj Reddy ,

VTPv3 should support the extended VLAN range without the need to use mode transparent.

This is another advantage of VTPv3 in addition to greater security as you have noted.

Hope to help

Giuseppe

[patoberli]

Thanks for your answers, I will soon try this.

[patoberli]

Just started the migration. I had the hope that it's enough to do on the new primary VTP server, sadly not. 

For the others, all switches in client mode must manually be set to "vtp mode 3". This will not cause any traffic interruption as far as I can tell. 

So the steps are:

On the new Primary:

9500R-SWV(config)# vtp version 3
9500R-SWV(config)# vtp domain somedomainnameifnonewasset
9500R-SWV(config)# vtp password somepasswordifnonewasset
9500R-SWV(config)# end
9500R-SWV#vtp primary vlan force 

Then on all VTP client switches:

2960x-1(config)# vtp version 3
2960x-1(config)# end

Start from the root/core switch going outwards. This will shortly cause high CPU load on the switches (depending on the VLANs). In my case with about 100 VLANs the conversion took about 2 seconds, but no traffic interruption was felt. 

[Giuseppe Larosa]

Hello @patoberli ,

thanks for your feedback on this thread.

Best Regards

Giuseppe