why switches in different VTP domain unable to ping.

[mahesh18]

hi all,

i did this lab test

Sw 1  VTP  server switch   domain manveer

Sw 2  VTP client switch domain manveer

i changed VTP domain on client switch from manveer  to mp after this

i am unable to telnet or  ping  Sw 2 switch.

from  Sw 1 i can see switch 2 as cdp nei but unable to ping it.

IF someone can explain me how VTP domain can stop ping between two cirectly connected switches.

Also port on Sw1  which was trunk port to sw 2  has become  now access port.

thanks

mahesh

[Giuseppe Larosa]

Hello Mahesh,

>> Also port on Sw1  which was trunk port to sw 2  has become  now access port.

This is a key point : when a trunk state is the result of a successful DTP (dynamic trunking protocol) negotation that is it is not manually configured, its state depends on DTP.

In the DTP messages the VTP domain is present or referred

The Cisco idea is that setting up automatically a trunk port carrying all Vlans between two switches in different VTP domains is not good so the port is reverted to access port.

One of the effects of access mode regression is loss of connectivity in all other vlans

so you were pinging over a tagged vlan on the trunk link, after it regresses to access mode you cannot anymore

You need to configure the trunk manually to restore connectivity.

switchport mode trunk

switchport nonegotiate

on both ends

Hope to help

Giuseppe

[mahesh18]

Hi Giuseppe,

so when i hard code both ends to  trunk mode and leave them on different domains then ping will work right?

also then VTP messages will not be exchanges as they are in different domain righ t?

but after hardcoding then as trunk then vlan data will pass over the trunk link even though they are in different VTP domains?

Mahesh

[Giuseppe Larosa]

Hello Mahesh,

1) yes if the ping in in a tagged vlan

2) yes VTP domain is different so received messages are ignored

3) yes, it is STP that decides if a link is used for a Vlan not VTP.

personally I prefer to configure trunk ports manually also because many environments skip VTP by putting all devices in VTP transparent mode.

DTP is too much willing to setup trunks also when you don't want them! and you can have bad surprises when you change VTP configuration as you have seen.

Hope to help

Giuseppe

[mahesh18]

Many thanks for reply.

i will test this and keep you posted.

mahesh

[mahesh18]

hi  Giuseppe,

i console in to other switch which was no reachable and check the logs

Jan 30 11:34:38.862 MST: %DTP-5-DOMAINMISMATCH: Unable to perform trunk negotiation on port Fa0/8 because of VTP domain mismatch.
Jan 30 11:39:26.097 MST: %SPANTREE-2-UNBLOCK_CONSIST_PORT: Unblocking FastEthernet0/8 on VLAN0001. Port consistency restored.
2950T#

Also port fa0/8 has Amber  light.

--Also port fa0/8 has become none trunk port as shown below

---2950T#sh int fa0/8 switchport
Name: Fa0/8
Switchport: Enabled
Administrative Mode: dynamic desirable**************************
Operational Mode: static access*******************************************
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Voice VLAN: none
Administrative private-vlan host-association: none
Administrative private-vlan mapping: none
Administrative private-vlan trunk native VLAN: none
Administrative private-vlan trunk encapsulation: dot1q
Administrative private-vlan trunk normal VLANs: none
Administrative private-vlan trunk private VLANs: none
Operational private-vlan: none
Trunking VLANs Enabled: ALL
Pruning VLANs Enabled: 2-1001
Capture Mode Disabled
Capture VLANs Allowed: ALL
Protected: false
Unknown unicast blocked: disabled
Unknown multicast blocked: disabled
Appliance trust: none
2950T#

STP  status shows

950T#sh spanning-tree int fa0/8

Vlan             Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
VLAN0001         Altn BLK 19        128.8    P2p
2950T#

Other side of switch shows

3550SMIA#sh spanning-tree int fa0/8

Vlan                Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
VLAN0001            Desg FWD 19        128.8    P2p

--Both fa0/8 ports are up up on both ends.

[mahesh18]

Hi,

   This is my observation when i did this ---I config both ends of switch -- hardcoded to trunk 

--- both fa0/8 ports are up and running ,light is green  and i can ping across each other.

--my pc gets ip address and i can access the internet.

--Both switches are  still in different VTP domain.

--when we change VTP domain of client switch then it config revsion number is set to 0  and it still remains client switch

----So this proves one point if cisco switches are  in different VTP  domain then we must  config ports as hard code them to  trunk  if we do

switchport mode dynamic desirable    then trunk does not establish and we are unable to ping between the switches.

so it means when they are in different VTP domain they are  exchanging VLan info across trunk and rest all info like ping,telnet cdp is being exhanged.???

[Giuseppe Larosa · Accepted solution]

Hello Mahesh,

>> so it means when they are in different VTP domain they are  exchanging VLan info across trunk and rest all info like ping,telnet cdp is being exhanged.???

when they are in different VTP domains they do not exchange vlan data base information and if the port is in dynamic desirable DTP negotiation fails as shown in the log message. The link becomes an access port and connectivity for all other vlans other then the native untagged vlan is impacted.

if you were using Vlan1 (not recommended for security reasons) the ping in vlan1 would not break when regressing the link to access mode.

>> Jan 30 11:34:38.862 MST: %DTP-5-DOMAINMISMATCH: Unable to perform trunk negotiation on port Fa0/8 because of VTP domain mismatch

I think your tests confirm the expected behaviuor if the broken IP connectivity happens in a vlan different then native vlan, vlan 1 in your case.

the port may become alternate blocking on one side because a better port in vlan 1 is present towards the root bridge.

Hope to help

Giuseppe

[mahesh18]

Hi Giuseppe,

Many thanks for great explanation.

regards

mahesh