7.1 VLANs, 802.1Q Trunking & VTPv3

7.1 VLANs, 802.1Q Trunking & VTPv3

Core Blueprint Focus: Cisco 350-401 ENCOR v1.2 topic 3.1.a (troubleshoot static and dynamic 802.1q trunking protocols) requires candidates to configure and verify Layer 2 switchport operations, diagnose trunking encapsulation mechanisms, evaluate Layer 2 security vulnerabilities (VLAN hopping, rogue trunk negotiation), configure Dynamic Trunking Protocol (DTP) states, and deploy VLAN Trunking Protocol Version 3 (VTPv3) in enterprise multi-switch topologies.

In modern enterprise campus architectures, Layer 2 infrastructure forms the foundation for data link forwarding, tenant segmentation, and wireless access integration. Proper segmentation, deterministic trunking, and secure VLAN propagation are essential to maintain high-performance switching and prevent Layer 2 attack vectors.

1. VLAN Foundations & Switchport Architecture

A Virtual Local Area Network (VLAN) partitions a single physical Layer 2 switch infrastructure into multiple distinct, isolated broadcast domains. By default, all switch ports belong to VLAN 1, creating a single broadcast domain where Layer 2 broadcasts, multicasts, and unknown unicasts are flooded out all active ports.

+-----------------------------------------------------------------------------------+
|                    LAYER 2 BROADCAST DOMAIN SEGMENTATION                         |
+-----------------------------------------------------------------------------------+
|  WITHOUT VLANS (Flat Network):                                                    |
|  [ Host A ] ----\                                                                 |
|  [ Host B ] -----> [ Catalyst 9300 Switch ] === (Broadcast flooded to ALL hosts)  |
|  [ Host C ] ----/                                                                 |
|                                                                                   |
|  WITH VLANS (Logical Segmentation):                                               |
|  [ Host A (VLAN 10: Engineering) ] ----\                                          |
|  [ Host B (VLAN 20: Finance)     ] -----> [ Catalyst 9300 ] (Isolated Broadcasts) |
|  [ Host C (VLAN 10: Engineering) ] ----/  (Inter-VLAN routing requires L3 router) |
+-----------------------------------------------------------------------------------+

VLAN Numbering & Storage Ranges

Cisco IOS-XE supports 4,096 VLAN IDs (0 to 4095), partitioned into specific architectural ranges:

• Reserved VLANs (0 and 4095): Reserved for protocol mechanisms and system operations; cannot be configured or used for user data.
• Default VLAN (VLAN 1): Present on all Cisco switches out-of-the-box. Cannot be deleted or renamed. Used as the default access VLAN and default native VLAN for control protocols (CDP, VTP, PAgP, DTP).
• Standard-Range VLANs (1 to 1005):
  • VLANs 1002 through 1005 are legacy defaults for Token Ring and FDDI (1002: fddi-default, 1003: token-ring-default, 1004: fddinet-default, 1005: trnet-default); they cannot be deleted.
  • In VTP Version 1 and 2 (Server/Client modes), standard VLAN configurations are saved in the non-volatile vlan.dat file located in flash storage, rather than the running or startup configuration.
• Extended-Range VLANs (1006 to 4094):
  • Created for service provider multi-tenancy, data center segmentation, and large enterprise fabrics.
  • In VTPv1 and VTPv2, extended VLANs can only be created when the switch is configured in VTP Transparent mode and are stored directly in the running-config / startup-config.
  • In VTPv3, extended-range VLANs can be created on the VTP Primary Server and propagated across the entire enterprise domain.

Access vs. Trunk Ports

Multi-VLAN Access Ports: Voice (Auxiliary) VLAN Architecture

Enterprise desktop environments typically connect an IP Phone directly to the switch, and daisy-chain a desktop PC to the IP Phone's internal 3-port switch. This deployment requires the switch port to service two distinct VLANs simultaneously:

+-----------------------------------------------------------------------------------+
|                         VOICE & DATA ACCESS PORT TOPOLOGY                         |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|  +---------------+        802.1Q Tagged (VLAN 150 / CoS 5)      +---------------+ |
|  | Cisco IP Phone | <===========================================> | Catalyst 9300 | |
|  +---------------+         Untagged Frame (VLAN 10 / CoS 0)      | Gigabit 1/0/1 | |
|         |           <-------------------------------------------> +---------------+ |
|         | (Internal 3-Port Switch)                                                |
|         v                                                                         |
|  +---------------+                                                                |
|  |   User PC     | (Sends standard untagged Ethernet frames)                      |
|  +---------------+                                                                |
+-----------------------------------------------------------------------------------+

• Data Traffic (PC): Frames from the workstation enter the phone untagged and are delivered across the access link to the switch as untagged frames, which the switch places into the configured access data VLAN (e.g., VLAN 10).
• Voice Traffic (IP Phone): The switch uses Cisco Discovery Protocol (CDP) or Link Layer Discovery Protocol - Media Endpoint Discovery (LLDP-MED) to inform the phone of the voice VLAN ID. The phone encapsulates VoIP packets with an 802.1Q tag containing the Voice VLAN ID (e.g., VLAN 150) and sets 802.1p Class of Service (CoS) = 5 for strict priority QoS queuing.

! Configure access port with separate voice and data VLANs
Switch(config)# interface GigabitEthernet 1/0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# switchport voice vlan 150
Switch(config-if)# spanning-tree portfast
Switch(config-if)# spanning-tree bpduguard enable

2. IEEE 802.1Q Trunking & Frame Tagging Mechanics

When Ethernet frames traverse a trunk link connecting two switches, the receiving switch must identify the originating VLAN of each frame. IEEE 802.1Q is the open industry standard for Layer 2 frame multiplexing.

+-----------------------------------------------------------------------------------+
|                         IEEE 802.1Q ETHERNET FRAME FORMAT                         |
+-----------------------------------------------------------------------------------+
| Standard Ethernet Frame:                                                          |
| +-------------+-------------+---------------+-----------------------+-----------+ |
| |  Dest MAC   | Source MAC  |  Type/Length  |     Data Payload      |    FCS    | |
| |  (6 Bytes)  |  (6 Bytes)  |   (2 Bytes)   |    (46-1500 Bytes)    | (4 Bytes) | |
| +-------------+-------------+---------------+-----------------------+-----------+ |
|                                                                                   |
| 802.1Q Tagged Frame (4-Byte Tag Inserted):                                         |
| +-------------+-------------+---------------+---------------+-------+-----------+ |
| |  Dest MAC   | Source MAC  | 802.1Q Tag    |  Type/Length  | Data  |  New FCS  | |
| |  (6 Bytes)  |  (6 Bytes)  |  (4 Bytes)    |   (2 Bytes)   |Payload| (4 Bytes) | |
| +-------------+-------------+---------------+---------------+-------+-----------+ |
|                             |                                                     |
|            +----------------+----------------+                                    |
|            |                                 |                                    |
|            v                                 v                                    |
|     +-------------+---------------------------------------+                       |
|     |    TPID     |                 TCI                   |                       |
|     |  (16 Bits)  |              (16 Bits)                |                       |
|     +-------------+-------------+------------+------------+                       |
|     |   0x8100    |  PCP / CoS  |    DEI     |  VLAN ID   |                       |
|     |             |  (3 Bits)   |  (1 Bit)   | (12 Bits)  |                       |
|     +-------------+-------------+------------+------------+                       |
+-----------------------------------------------------------------------------------+

Detailed 802.1Q 4-Byte Tag Architecture

1. Tag Protocol Identifier (TPID - 16 bits / 2 bytes):
   • Set to the fixed hexadecimal value 0x8100.
   • Identifies the frame as an IEEE 802.1Q-tagged frame. Legacy non-802.1Q devices interpret this field as the EtherType and drop the frame if unsupported.
2. Tag Control Information (TCI - 16 bits / 2 bytes):
   • Priority Code Point (PCP / 802.1p CoS - 3 bits): Specifies Layer 2 Quality of Service (QoS) marking, providing 8 distinct priority levels ($2^3 = 8$, from 0 best-effort to 7 highest-priority network control; voice typically uses 5).
   • Drop Eligible Indicator (DEI / CFI - 1 bit): Formerly the Canonical Format Indicator (CFI) for Token Ring compatibility. In modern Ethernet, DEI indicates frames that may be dropped first during downstream buffer congestion.
   • VLAN Identifier (VID - 12 bits): Specifies the VLAN to which the frame belongs. With 12 bits, it supports up to $2^{12} = 4096$ VLAN IDs (values 0 and 4095 reserved, usable range 1 to 4094).

Frame Check Sequence (FCS) Recalculation

Because the 4-byte 802.1Q tag is inserted directly into the original Ethernet frame header between the Source MAC address and the Type/Length field, the switch must recompute the 4-byte Frame Check Sequence (FCS) CRC checksum prior to transmitting the frame across the trunk link.

Native VLAN Operation

• Untagged Forwarding: By default, frames belonging to the Native VLAN (VLAN 1 by default) are transmitted across an 802.1Q trunk without an 802.1Q tag (untagged).
• Ingress Handling: When a switch receives an untagged frame on an 802.1Q trunk port, it automatically assigns that frame to its configured local Native VLAN.
• Native VLAN Mismatch: If Switch A configures Native VLAN 10 on a trunk and Switch B configures Native VLAN 20, traffic originating in VLAN 10 on Switch A will emerge untagged and be placed directly into VLAN 20 on Switch B. Cisco Discovery Protocol (CDP) detects this condition and generates %CDP-4-NATIVE_VLAN_MISMATCH syslog alarms.
• Native VLAN Tagging (vlan dot1q tag native): To enhance security and prevent VLAN hopping, global command vlan dot1q tag native forces the switch to tag all frames across 802.1Q trunks, including Native VLAN frames.

3. VLAN Hopping Attacks & Hardening Strategies

Layer 2 security is paramount because a compromised Layer 2 domain bypasses upper-layer firewalls and access lists. VLAN Hopping allows an attacker on one VLAN to inject traffic into a different, unauthorized VLAN.

+-----------------------------------------------------------------------------------+
|                         DOUBLE TAGGING VLAN HOPPING ATTACK                        |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|  [ Attacker ] (Connected to Access Port in Native VLAN 10)                        |
|       |                                                                           |
|       | Crafts Double-Tagged Frame:                                               |
|       | [ Outer Tag: VLAN 10 (Native) ] [ Inner Tag: VLAN 20 (Target) ] [ Data ]  |
|       v                                                                           |
|  +---------------+                                                                |
|  | Switch 1      | (Native VLAN = 10)                                             |
|  |               | 1. Receives frame on VLAN 10.                                  |
|  |               | 2. Strips Outer Tag (VLAN 10) because it matches Native VLAN.  |
|  |               | 3. Forwards frame across Trunk WITHOUT outer tag.              |
|  +---------------+                                                                |
|       |                                                                           |
|       | Frame on Trunk Link:                                                      |
|       | [ Inner Tag: VLAN 20 (Target) ] [ Data Payload ]                          |
|       v                                                                           |
|  +---------------+                                                                |
|  | Switch 2      | (Trunk Port Receives Frame)                                    |
|  |               | 1. Reads remaining 802.1Q tag (VLAN 20).                       |
|  |               | 2. Strips VLAN 20 tag.                                         |
|  |               | 3. Forwards frame directly to Victim on VLAN 20!               |
|  +---------------+                                                                |
|       |                                                                           |
|       v                                                                           |
|  [ Victim Host ] (VLAN 20) receives unauthorized packet!                          |
+-----------------------------------------------------------------------------------+

Attack Vector 1: Switch Spoofing

• Mechanism: An attacker connects a rogue workstation running packet generation tools (such as Yersinia or Scapy) to an access port where trunk negotiation is active (Dynamic Trunking Protocol / DTP default mode dynamic desirable or dynamic auto). The attacker generates DTP negotiation frames, tricking the switch into establishing an 802.1Q trunk. Once the trunk is formed, the attacker can transmit and receive traffic across all active VLANs.
• Mitigation: Explicitly disable DTP on all user-facing ports using switchport mode access and switchport nonegotiate.

Attack Vector 2: Double-Tagging (802.1Q Double Encapsulation)

• Mechanism:
  1. The attacker must be connected to an access port in the same VLAN as the trunk's Native VLAN (e.g., Native VLAN 10).
  2. The attacker crafts a frame containing two 802.1Q headers: Outer Tag = VLAN 10 (Native), Inner Tag = VLAN 20 (Victim's Target VLAN).
  3. Switch 1 receives the frame. Because the outer tag matches the Native VLAN of the outbound trunk, Switch 1 strips the outer tag and transmits the frame untagged with the inner tag intact.
  4. Switch 2 receives the frame on the trunk. It inspects the first tag it sees (the inner tag for VLAN 20), strips the tag, and delivers the payload to the victim in VLAN 20.
  5. Note: Double-tagging is strictly unidirectional (the attacker cannot receive return packets because return traffic is not double-tagged), but it is potent for launching blind UDP denial-of-service, DNS cache poisoning, or TCP SYN floods.
• Mitigation:
  • Change the Native VLAN on all trunks to an unused, dedicated dummy VLAN ID (e.g., VLAN 999).
  • Ensure no user access ports are assigned to the dummy Native VLAN.
  • Enable global native VLAN tagging: vlan dot1q tag native.

Layer 2 Trunk Hardening Best Practices

! 1. Global Native VLAN Tagging (Enforces 802.1Q tags on ALL frames)
Switch(config)# vlan dot1q tag native

! 2. Harden Trunk Uplink Interfaces
Switch(config)# interface GigabitEthernet 1/0/48
Switch(config-if)# description UPLINK-TO-CORE
Switch(config-if)# switchport trunk encapsulation dot1q
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport nonegotiate
Switch(config-if)# switchport trunk native vlan 999
Switch(config-if)# switchport trunk allowed vlan 10,20,30,150

! 3. Harden Access Host Interfaces
Switch(config)# interface range GigabitEthernet 1/0/1 - 24
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 10
Switch(config-if-range)# switchport nonegotiate
Switch(config-if-range)# spanning-tree portfast
Switch(config-if-range)# spanning-tree bpduguard enable

4. Dynamic Trunking Protocol (DTP) Modes & Negotiation Matrix

Dynamic Trunking Protocol (DTP) is a Cisco proprietary point-to-point Layer 2 protocol used to negotiate trunk links between interconnected switch ports.

DTP Operational Modes

1. switchport mode access: Permanently puts the interface into non-trunking (access) mode. The port actively generates DTP frames to negotiate the remote neighbor into an access state.
2. switchport mode trunk: Permanently puts the interface into trunking mode. The port actively transmits DTP frames to negotiate the remote neighbor into a trunk state.
3. switchport mode dynamic desirable: Actively initiates negotiation. The port periodically transmits DTP packets asking the remote neighbor to form a trunk link.
4. switchport mode dynamic auto: Passively listens for DTP negotiation. The port responds to incoming DTP requests but does not actively initiate negotiation. If both sides are set to dynamic auto, no negotiation occurs and the link remains in access mode.
5. switchport nonegotiate: Disables all DTP frame generation. The port will not send or parse DTP frames. Can only be configured when the switchport is explicitly set to switchport mode trunk or switchport mode access.

DTP Negotiation Outcome Matrix

[!IMPORTANT] On older Cisco Catalyst switches (such as Catalyst 2960/3560), the default switchport state is dynamic auto or dynamic desirable. On modern enterprise switches running Cisco IOS-XE (Catalyst 9000 series), the default switchport state is dynamic auto or static access. For production enterprise deployments, best practice mandates setting explicit static modes (switchport mode trunk or switchport mode access) paired with switchport nonegotiate to eliminate DTP overhead and prevent spoofing.

5. VLAN Trunking Protocol Version 3 (VTPv3) Architecture

The VLAN Trunking Protocol (VTP) synchronizes VLAN database definitions across Layer 2 switches within a common VTP administrative domain. While VTPv1 and VTPv2 suffered from severe security flaws—most notably the catastrophic "VTP revision bomb" where adding a switch with a higher revision number erased the entire network's VLAN database—VTP Version 3 (VTPv3) introduces enterprise-grade safeguards and multi-protocol scaling.

+-----------------------------------------------------------------------------------+
|                         VTPv3 DOMAIN ARCHITECTURE                                 |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|                 +-----------------------------------------+                       |
|                 |           VTPv3 PRIMARY SERVER          |                       |
|                 |  - Only device permitted to edit VLANs  |                       |
|                 |  - Issues 'vtp primary' command         |                       |
|                 |  - Increments Configuration Revision    |                       |
|                 +-----------------------------------------+                       |
|                                    |                                              |
|                      VTPv3 Updates | (Propagates VLANs 1-4094,                    |
|                     over Trunk     |  MST Instances, Hidden Pwd)                  |
|                                    v                                              |
|         +--------------------------+--------------------------+                   |
|         |                                                     |                   |
|         v                                                     v                   |
|  +----------------------+                           +----------------------+      |
|  | VTPv3 SECONDARY SRV  |                           |     VTPv3 CLIENT     |      |
|  | - Stores in NVRAM    |                           | - Stores in DRAM RAM |      |
|  | - CANNOT edit VLANs  |                           | - CANNOT edit VLANs  |      |
|  | - Forwards Updates   |                           | - Forwards Updates   |      |
|  +----------------------+                           +----------------------+      |
+-----------------------------------------------------------------------------------+

Critical Enhancements in VTPv3

1. Primary Server Role & Configuration Authority:
   • In VTPv1/v2, any server could create, modify, or delete VLANs, and any switch with a higher Configuration Revision number would overwrite the network.
   • In VTPv3, standard server switches are Secondary Servers by default and are strictly read-only. VLANs cannot be created or modified on a secondary server.
   • To modify VLANs, an administrator must explicitly promote an authorized switch to the VTP Primary Server using the EXEC command vtp primary [vlan | mst] [force].
   • The Primary Server ownership is protected by token-based authorization. When an administrator promotes a switch, it takes ownership of the primary server role and broadcasts a takeover message across the domain. A rogue switch plugged into the network—even with a higher revision number—will never overwrite the VTPv3 domain.
2. Extended-Range VLAN Propagation (1 to 4094):
   • VTPv1 and VTPv2 only propagate standard VLANs (1-1005).
   • VTPv3 propagates the entire 12-bit VLAN space (VLANs 1 through 4094).
3. Multiple Spanning Tree (MST) Database Propagation:
   • VTPv3 can propagate MST configuration parameters (Region Name, Revision Number, and VLAN-to-Instance mapping tables) across switches using vtp mode server mst / vtp primary mst.
4. Private VLANs (PVLAN) Support:
   • VTPv3 automatically propagates Primary, Isolated, and Community Private VLAN mappings across trunk links.
5. Cryptographic & Hidden Password Protection:
   • VTP passwords can be configured with the hidden or secret keyword (vtp password <string> hidden), storing the password as an MD5/SHA-256 cryptographic hash in the configuration file rather than plain text.
6. VTP Mode Off:
   • Unlike VTP Transparent mode (which parses and forwards incoming VTP advertisements on trunk ports without processing them locally), VTP Mode Off completely disables the VTP protocol process and drops all received VTP frames at the ingress ASIC without forwarding.

6. Cisco IOS-XE VTPv3 Configuration & Verification

1. Configure VTPv3 Domain & Primary Server

! Step 1: Set VTP Version 3 globally
Core-Switch(config)# vtp version 3

! Step 2: Configure Domain Name and Hidden Password
Core-Switch(config)# vtp domain ENTERPRISE_CAMPUS
Core-Switch(config)# vtp password CiscoEnc0rSecurePass#1 hidden

! Step 3: Configure VTP Mode as Server
Core-Switch(config)# vtp mode server
Core-Switch(config)# exit

! Step 4: Promote switch to VTP Primary Server for VLAN database
Core-Switch# vtp primary vlan
This system is becoming the primary server for feature vlan
No conflicting primary server found in domain.
Do you want to continue? [confirm] <Enter>
Core-Switch#
%VTP-6-PRIMARY_SERVER_CHG: Switch 5006.0420.0001 has become the primary server for feature vlan

! Step 5: Create Extended-Range VLANs on the Primary Server
Core-Switch(config)# vlan 10,20,30,100,150,1050,2000-2010
Core-Switch(config-vlan)# exit

2. Configure VTPv3 Client Switch

Access-Switch(config)# vtp version 3
Access-Switch(config)# vtp domain ENTERPRISE_CAMPUS
Access-Switch(config)# vtp password CiscoEnc0rSecurePass#1 hidden
Access-Switch(config)# vtp mode client
Access-Switch(config)# exit

3. Verification & Troubleshooting Commands

Core-Switch# show vtp status
VTP Version capable             : 1 to 3
VTP version running             : 3
VTP Domain Name                 : ENTERPRISE_CAMPUS
VTP Pruning Mode                : Disabled
VTP Logging                     : Disabled
VTP Traps Generation           : Disabled
Interface Trunk Group           : None

Feature VLAN:
--------------
VTP Operating Mode                : Server
Number of existing VLANs          : 22
Number of existing extended VLANs : 11
Configuration Revision            : 6
Primary ID                        : 5006.0420.0001
Primary Description               : Core-Switch
MD5 digest                        : 0x4A 0x82 0x3F 0x91 0x1E 0x7B 0xCC 0x05

Feature MST:
--------------
VTP Operating Mode                : Transparent

! Verify VLAN Synchronization on Client Switch
Access-Switch# show vlan brief
VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi1/0/2, Gi1/0/3
10   VLAN0010                         active    Gi1/0/10
20   VLAN0020                         active    Gi1/0/11
150  VLAN0150                         active    Gi1/0/12
1050 VLAN1050                         active
2000 VLAN2000                         active