WEBVTT 00:00:00.000 --> 00:00:23.000 VTP, VLAN Trunking Protocol. It's not an exam objective. It's not. But it is one of those topics that could show up on the certification exam either as a distractor or potentially as the real answer. 00:00:23.000 --> 00:00:34.000 Therefore, it's really important for us to have a fundamental understanding of VTP, VLAN Trunking Protocol, what it is, what it's not, and some of the dangers behind it. 00:00:34.000 --> 00:00:45.000 So that way if you are running it in your organization, whether you know or not, the end result is you might want to make a few adjustments to it to make sure you are as safe and secure as you possibly can be. 00:00:45.000 --> 00:00:58.000 So when it comes to VLAN Trunking Protocol, what are we dealing with? We are dealing with a protocol that has the ability to support the auto propagation of VLANs across what we call in this case a VTP domain. 00:00:58.000 --> 00:01:07.000 So your VTP domain is a collection of switches that are allowed to share VLAN information with each other. That's what a VTP domain is. 00:01:07.000 --> 00:01:15.000 So essentially you put the switch in the same VTP domain as this one, this one, this one, then they can exchange VTP messages with each other. 00:01:15.000 --> 00:01:23.000 Now why would we exchange VTP messages with each other? So we can share our VLAN database information with each other. 00:01:23.000 --> 00:01:37.000 Now this was a protocol that was designed back in the day. What do I mean by back in the day? Well let's go back to this picture that we drew a little earlier today. 00:01:37.000 --> 00:01:44.000 Remember when we said there was a time in our lives when we had our entire environment was Layer 2? 00:01:45.000 --> 00:01:58.000 And so Cisco created a proprietary protocol called DTP for their own environments. That was a plug and play technology. DTP allowed two switches when connected together to automatically form a trunk with each other. 00:01:58.000 --> 00:02:13.000 Now what else has to happen in this entire environment for all of this to work? Every single switch needs to know every single VLAN. 00:02:15.000 --> 00:02:26.000 Everyone, you got a thousand switches, they all must be configured with the same VLAN information or else what would happen? They can't pass traffic for that VLAN. 00:02:29.000 --> 00:02:41.000 So it's a lot of work to configure that many switches with all those VLANs. But also if you added another switch to the environment, so let's say I connected another switch here. 00:02:42.000 --> 00:03:02.000 Trunks formed automatically using DTP. With VTP, VLAN trunking protocol, this switch would tell this switch all of the VLANs. 00:03:03.000 --> 00:03:12.000 So if you had 50 VLANs configured here, this switch would now know all 50 VLANs. That's what VTP does for us. 00:03:13.000 --> 00:03:22.000 So why is it called VLAN trunking protocol? Because it only works over trunk links. That's it. 00:03:23.000 --> 00:03:33.000 So VLAN trunking protocol is about sharing VLANs over existing trunk links. That's where the name comes from. It's honestly a pretty bad name. 00:03:34.000 --> 00:03:41.000 Because it has nothing to do with trunking. It uses trunks in order to pass the information. 00:03:42.000 --> 00:03:53.000 So modern day networks don't look like this. So if we erase all of this, what do we have typically? We might have our environment like this today. 00:04:03.000 --> 00:04:07.000 Oh, all of this is layer three, even the entire data center today. 00:04:10.000 --> 00:04:15.000 Up here, what do we have? We've got layer two. Down here, we've got layer two. 00:04:16.000 --> 00:04:21.000 So are there typically going to be a lot of VLANs here? 00:04:21.000 --> 00:04:35.000 Not really. If I add another switch, could I easily create those VLANs on the new switch instead of relying on VTP? 00:04:36.000 --> 00:04:46.000 If I add a VLAN to this layer two environment, could I easily add the VLAN to all my switches? Probably. 00:04:46.000 --> 00:04:56.000 So there is a balancing point here. That balancing point is do I really need VTP or not? Do I really need DTP or not? 00:04:57.000 --> 00:05:07.000 So we know that with DTP, if I'm configuring a switch to be a trunk, then more than likely that link is going to be a trunk forever and ever and ever. 00:05:08.000 --> 00:05:12.000 So might as well just manually say switch port mode trunk, we're done. Switch port no negotiate. 00:05:13.000 --> 00:05:20.000 But now the question about VTP is, well, is it going to make my life easier as an admin? 00:05:21.000 --> 00:05:30.000 Whereby if we want to add now VLAN 50 to this environment, I go to this switch, type in VLAN 50, and then that gets automatically shared with the other switches. 00:05:31.000 --> 00:05:33.000 If that's what you want to do, then fine, you need VTP. 00:05:34.000 --> 00:05:44.000 But if you have the ability to maybe have a script to configure the VLANs on all those switches you could, or if you want to log in all of them and configure them, it's up to you. 00:05:45.000 --> 00:05:49.000 So this is one of those protocols where it's, you know, some people love it, some people hate it. It's one or the other. 00:05:50.000 --> 00:05:55.000 And the reason why people hate it is because of how dangerous it could be. 00:05:56.000 --> 00:06:02.000 Or on how unnecessary it is for them to have to learn another thing and run another thing in their environment. 00:06:03.000 --> 00:06:07.000 So with VTP, remember, this is Cisco proprietary. 00:06:08.000 --> 00:06:12.000 So if you have some non-Cisco switches connected to Cisco switches, VTP is not going to help you out. 00:06:13.000 --> 00:06:14.000 Same thing with DTP. 00:06:15.000 --> 00:06:21.000 These are Cisco proprietary protocols, meaning all your devices are going to have to be Cisco in that environment for it to work. 00:06:24.000 --> 00:06:30.000 So we support the auto-propagation of VLANs between the switches in the same VTP domain across our trunk links. 00:06:30.000 --> 00:06:38.000 VLANs are going to be written in the VLAN database, stored in Flash, that vlan.dat file. 00:06:39.000 --> 00:06:46.000 Which means by default, if you need something like VLAN 2000, well, that is in the expanded range of VLANs. 00:06:47.000 --> 00:06:51.000 Well, VTP version 1, VTP version 2 is not going to support that. 00:06:52.000 --> 00:06:53.000 Server mode is not going to support that. 00:06:53.000 --> 00:06:54.000 Client mode is not going to support that. 00:06:55.000 --> 00:07:00.000 So you're going to have to change modes, change versions, all these different things. 00:07:01.000 --> 00:07:02.000 We're going to talk about that a little later on. 00:07:03.000 --> 00:07:04.000 Because those are the things I want you to know for the exam. 00:07:05.000 --> 00:07:06.000 I've got a page for it. 00:07:07.000 --> 00:07:14.000 So also we have to realize that the domain name is null by default on your switch. 00:07:15.000 --> 00:07:16.000 This is where the dangers come into play. 00:07:17.000 --> 00:07:21.000 Because let's say you've inherited a network and nobody's ever used VTP in that network. 00:07:21.000 --> 00:07:28.000 It is possible that you are vulnerable right now if nobody adjusted the default values of VTP. 00:07:29.000 --> 00:07:35.000 When you're adding a new switch to your environment, or maybe an old one off the shelf and you're repurposing it. 00:07:36.000 --> 00:07:39.000 You've set it back to factory default settings. 00:07:40.000 --> 00:07:42.000 Again, domain name null. 00:07:43.000 --> 00:07:44.000 What does that mean? 00:07:45.000 --> 00:07:48.000 Well, let's take a peek in our live environment about what that means. 00:07:48.000 --> 00:07:59.000 If we type in show VTP status, you're going to see my VTP domain name is null. 00:08:00.000 --> 00:08:01.000 It means nothing. 00:08:02.000 --> 00:08:03.000 It means blank. 00:08:04.000 --> 00:08:15.000 What you need to realize is that when your domain name is null, your switch is trying really hard to join a domain. 00:08:16.000 --> 00:08:17.000 It wants to be part of a domain. 00:08:18.000 --> 00:08:19.000 And that's the way it's designed. 00:08:20.000 --> 00:08:22.000 Now, is it actively seeking to join a domain? 00:08:23.000 --> 00:08:24.000 No, it's not. 00:08:25.000 --> 00:08:28.000 But if somebody comes along and says, hey, I'm part of a domain, this switch will go, oh, let me join you. 00:08:29.000 --> 00:08:30.000 And it'll jump on board. 00:08:31.000 --> 00:08:36.000 Regardless of whether it's a valid VTP domain name or not. 00:08:37.000 --> 00:08:40.000 Because it's plug and play. 00:08:41.000 --> 00:08:44.000 Remember when it was created, it was a time when plug two switches together. 00:08:45.000 --> 00:08:46.000 DTP forms a trunk. 00:08:46.000 --> 00:08:47.000 VTP then runs. 00:08:48.000 --> 00:08:53.000 So you automatically join the existing VTP domain and you learn all the VLANs. 00:08:54.000 --> 00:08:56.000 That's why it behaves this way. 00:08:57.000 --> 00:09:10.000 So null means if somebody I get connected to is part of a domain, I will join their domain and learn all their VLANs and synchronize my VLANs with them. 00:09:11.000 --> 00:09:20.000 So just picture a scenario where somebody connects a rogue switch to your switch. 00:09:21.000 --> 00:09:24.000 And your switch is not part of a domain. 00:09:25.000 --> 00:09:28.000 But the rogue switch is part of a domain. 00:09:30.000 --> 00:09:38.000 Does that mean your production switch in your production environment would join that switch's domain? 00:09:39.000 --> 00:09:48.000 Well, if that switch, when connected to this switch, successfully formed a trunk link, then yeah, absolutely, because it's part of a domain. 00:09:49.000 --> 00:09:50.000 What does that then mean? 00:09:51.000 --> 00:09:54.000 All of its rogue VLAN information is now going to be on my switch. 00:09:55.000 --> 00:09:56.000 Now what about all my other switches? 00:09:57.000 --> 00:09:59.000 Well, of all my other switches, domain names are null as well. 00:10:00.000 --> 00:10:01.000 Guess what? 00:10:01.000 --> 00:10:05.000 They will all then join that domain and all synchronize their databases. 00:10:06.000 --> 00:10:11.000 And therefore, we now have a corrupt VLAN database and nobody can get any work done. 00:10:13.000 --> 00:10:20.000 So if you have any switches in your environment that don't have a domain name, you might be vulnerable to that type of scenario situation. 00:10:21.000 --> 00:10:24.000 Which could be a resume generating event for you. 00:10:25.000 --> 00:10:26.000 Could be, I don't know. 00:10:28.000 --> 00:10:29.000 Let me show that for you. 00:10:29.000 --> 00:10:38.000 What we're going to do here is we are going to go to DSW-1 and type in show VDB status. 00:10:39.000 --> 00:10:40.000 Again, null. 00:10:41.000 --> 00:10:42.000 Let's go to DSW-2. 00:10:43.000 --> 00:10:44.000 Show VDB status. 00:10:45.000 --> 00:10:46.000 Again, null. 00:10:47.000 --> 00:10:48.000 Let's go to ASW-2. 00:10:49.000 --> 00:10:50.000 Show VDB status. 00:10:51.000 --> 00:10:55.000 Now remember, we have trunk links configured between all the devices because we've already configured them before. 00:10:56.000 --> 00:10:57.000 Again, null here. 00:10:57.000 --> 00:11:04.000 So what we're going to do is we're going to go to ASW-1 and I'm going to type in VTP domain ROGUERO. 00:11:05.000 --> 00:11:06.000 Just for fun. 00:11:07.000 --> 00:11:15.000 And what I want you to realize is that we have now all my other switches have automatically joined that domain. 00:11:21.000 --> 00:11:22.000 Incredible. 00:11:23.000 --> 00:11:25.000 Why? Because that's the way they're designed to behave. 00:11:26.000 --> 00:11:39.000 So if ASW-1 had a corrupt, bogus, not correct VLAN database, then all of those switches would now have that same bogus VLAN database. 00:11:40.000 --> 00:11:41.000 Which could be bad. 00:11:42.000 --> 00:11:47.000 For example, if I type in show VLAN brief right now, we'll see that we have which VLANs? 00:11:48.000 --> 00:11:49.000 1, 10, 20, 50, 200. 00:11:50.000 --> 00:11:53.000 Let's go ahead and say VLAN 100. 00:11:53.000 --> 00:11:54.000 100. 00:11:55.000 --> 00:11:56.000 Exit. 00:11:57.000 --> 00:11:59.000 So I added VLAN 100 to ASW-1's database. 00:12:10.000 --> 00:12:13.000 And you'll see it's in ASW-1's database. 00:12:14.000 --> 00:12:16.000 But let's go over to ASW-2 right now. 00:12:19.000 --> 00:12:21.000 It's also in this database now. 00:12:21.000 --> 00:12:22.000 Let's go to ASW-1. 00:12:24.000 --> 00:12:25.000 It's also in this database. 00:12:25.000 --> 00:12:29.000 So you can see how being part of the same VTP domain is very beneficial. 00:12:30.000 --> 00:12:33.000 But if you're not protecting your VTP domain, it's very dangerous. 00:12:34.000 --> 00:12:44.000 So if you have any switches right now, folks, that are not part of a VTP domain, I encourage you to come up with a plan and follow your change management practices to at least get a domain name configured on those switches. 00:12:45.000 --> 00:12:55.000 That is going to then protect them because once you're part of a domain, you're not going to join some other domain unless you're forced to join it by me configuring the domain name. 00:12:56.000 --> 00:13:02.000 So for example, if on ASW-2 right now I type in VTP domain is ENCOR. 00:13:04.000 --> 00:13:08.000 If we go to ASW-1 right now, you'll see that it's still in the rogue VTP domain. 00:13:09.000 --> 00:13:11.000 So once you're in a domain, you're not going to want to change that domain. 00:13:12.000 --> 00:13:20.000 But now that this device is receiving messages from DSW-2 that says it's from the rogue domain, it's just going to ignore those messages. 00:13:21.000 --> 00:13:24.000 So you ignore messages from somebody in a different VTP domain than you are in. 00:13:26.000 --> 00:13:30.000 So at a minimum, you should have a VTP domain name configured, at a minimum. 00:13:31.000 --> 00:13:32.000 I'm going to change all of them. 00:13:33.000 --> 00:13:38.000 And don't forget, you're only going to share and synchronize your databases with those that are in the same domain. 00:13:38.000 --> 00:13:43.000 So let me go ahead and change all these to VTP domain ENCOR so that way they're all part of the same VTP domain. 00:13:56.000 --> 00:13:57.000 So you're all part of the same VTP domain. 00:13:58.000 --> 00:14:03.000 Now, the thing is that a rogue device could still enter your domain, enter your environment. 00:14:04.000 --> 00:14:17.000 And if that rogue device has the ability to form a trunk link with your switch, and it has the same domain name, then it can still infect your environment, right? 00:14:18.000 --> 00:14:19.000 So what's the other thing you want to do? 00:14:20.000 --> 00:14:22.000 You want to set up a VTP password just to be on the safe side. 00:14:23.000 --> 00:14:26.000 So I'm going to set my VTP password to the same on all of these devices. 00:14:34.000 --> 00:14:36.000 All right, so set a domain name. 00:14:37.000 --> 00:14:39.000 Come on, set a password. 00:14:40.000 --> 00:14:41.000 Come on, there we go. 00:14:43.000 --> 00:14:46.000 All right, so make sure the password is the same on all the devices. 00:14:47.000 --> 00:14:49.000 So step one, make sure you've got a domain name. 00:14:50.000 --> 00:14:52.000 Make sure you've got a password at a minimum. 00:14:54.000 --> 00:14:59.000 And then all your devices now, if you configure your VLAN, if you configure your VLAN, 00:14:59.000 --> 00:15:09.000 and then all your devices now, if you configure your VLAN information on one switch, it'll be propagated to all the other switches as well. 00:15:11.000 --> 00:15:18.000 Now, I'm going to go to my diagram here first to say another way you can protect yourself is make sure that all these ports here are what? 00:15:19.000 --> 00:15:20.000 All these ports are what? 00:15:21.000 --> 00:15:22.000 What's the magic word? 00:15:24.000 --> 00:15:25.000 It's a six letter word. 00:15:26.000 --> 00:15:28.000 What type of ports do we want those to be? 00:15:29.000 --> 00:15:30.000 Yes. 00:15:31.000 --> 00:15:32.000 Why? 00:15:33.000 --> 00:15:34.000 Why does this protect us? 00:15:35.000 --> 00:15:36.000 Why does this protect VTP? 00:15:43.000 --> 00:15:56.000 Because if somebody connects a rogue switch to us on any of those ports, a trunk will not be formed. 00:15:56.000 --> 00:15:59.000 VTP only works on trunks. 00:16:00.000 --> 00:16:02.000 No trunk, no VTP. 00:16:03.000 --> 00:16:06.000 Therefore, if those are access ports, that's what you do. 00:16:07.000 --> 00:16:13.000 So what you do is these ports are trunk ports on this device. 00:16:14.000 --> 00:16:15.000 45, 46, 47, 48. 00:16:16.000 --> 00:16:18.000 So ports one through 44. 00:16:19.000 --> 00:16:31.000 Whether I'm using them or not, the recommended security best practice is switch port, mode, access for all of them. 00:16:32.000 --> 00:16:33.000 Whether you're using them or not. 00:16:34.000 --> 00:16:42.000 So right now in our environment on ASW1, the best thing to do is interface range gigabit Ethernet 1.0.1 through 44. 00:16:43.000 --> 00:16:47.000 Switch port, mode, access, all of them that are not trunks. 00:16:48.000 --> 00:16:49.000 So essentially your switch. 00:16:50.000 --> 00:16:53.000 If the port needs to be a trunk, you configure it as a trunk. 00:16:54.000 --> 00:16:57.000 If it's not going to be a trunk, type this command in whether you're using it or not. 00:16:58.000 --> 00:16:59.000 Whether it's enabled or not, doesn't matter. 00:17:00.000 --> 00:17:01.000 Type this command in. 00:17:02.000 --> 00:17:04.000 That'll protect you from any rogue VTP problems. 00:17:10.000 --> 00:17:11.000 All right. 00:17:12.000 --> 00:17:16.000 Now, when you're using VTP, we have a couple of different modes here. 00:17:16.000 --> 00:17:19.000 Before we even talk about the modes, let me group them together. 00:17:20.000 --> 00:17:21.000 These two work together. 00:17:22.000 --> 00:17:23.000 This works by itself. 00:17:24.000 --> 00:17:25.000 This works by itself. 00:17:26.000 --> 00:17:33.000 Now, originally there was only these three options. 00:17:34.000 --> 00:17:35.000 Off never existed. 00:17:36.000 --> 00:17:37.000 It never did. 00:17:38.000 --> 00:17:39.000 And then eventually off was created. 00:17:40.000 --> 00:17:41.000 So here's the deal. 00:17:42.000 --> 00:17:43.000 If you don't want to use VTP today, you just shut it off. 00:17:44.000 --> 00:17:45.000 VTP mode off. 00:17:46.000 --> 00:17:47.000 Shut off VTP. 00:17:48.000 --> 00:17:52.000 What that means is that on that device, you will have to configure your VLANs manual. 00:17:53.000 --> 00:17:54.000 That's it. 00:17:55.000 --> 00:18:00.000 So if you have 100 switches and you shut off VTP, then you got to configure your switches manually with your VLANs. 00:18:01.000 --> 00:18:07.000 Or use scripts or use a configuration tool that can push the configs to the device. 00:18:08.000 --> 00:18:09.000 That's fine. 00:18:10.000 --> 00:18:12.000 But if you don't need VTP, off is the best way to go. 00:18:12.000 --> 00:18:16.000 But before V off existed, we had to use transparent mode to essentially shut it off. 00:18:17.000 --> 00:18:18.000 Well, let's talk about server and client first of all. 00:18:19.000 --> 00:18:20.000 So what do we mean by server and client? 00:18:21.000 --> 00:18:25.000 We mean your switch is using a mode called server mode or client mode. 00:18:26.000 --> 00:18:28.000 A lot of people get confused with that and they're thinking like, oh, you may have to set up a server. 00:18:29.000 --> 00:18:30.000 No, no, no, that's not what we're talking about. 00:18:31.000 --> 00:18:38.000 So if right now we go to DSW1 as an example and we just scroll up, you'll see the operating mode right now is server mode. 00:18:39.000 --> 00:18:41.000 So operating mode, server mode. 00:18:42.000 --> 00:18:43.000 What in the world does that mean? 00:18:44.000 --> 00:18:45.000 Let's take a peek at that. 00:18:46.000 --> 00:18:50.000 So server mode, let's type an S there or put an S for server mode. 00:18:51.000 --> 00:18:55.000 Send and receive VTP messages, configure VLANs and synchronize database. 00:18:56.000 --> 00:18:57.000 So configure VLANs. 00:18:58.000 --> 00:18:59.000 So let's configure VLAN 10. 00:19:00.000 --> 00:19:04.000 Let's configure VLAN 20 on this device in server mode. 00:19:04.000 --> 00:19:17.000 I can then send a VTP message out indicating that VLAN 10 and VLAN 20 have been added to my database. 00:19:18.000 --> 00:19:29.000 If you're in server mode, let's make this one server mode as well, you can receive VTP messages and then synchronize your database. 00:19:30.000 --> 00:19:32.000 So now I have VLAN 10 and I have VLAN 20. 00:19:33.000 --> 00:19:34.000 Through VTP. 00:19:42.000 --> 00:19:43.000 All right, let's look at client mode. 00:19:44.000 --> 00:19:45.000 So this one's client, let's say. 00:19:46.000 --> 00:19:47.000 Look at client mode. 00:19:48.000 --> 00:19:51.000 It says you cannot configure VLANs, cannot. 00:19:57.000 --> 00:19:58.000 Oops, wrong button. 00:19:59.000 --> 00:20:00.000 There we go. 00:20:03.000 --> 00:20:06.000 VTP mode. 00:20:07.000 --> 00:20:08.000 Client. 00:20:09.000 --> 00:20:11.000 VLAN 66. 00:20:14.000 --> 00:20:15.000 Can't do it. 00:20:16.000 --> 00:20:17.000 Cannot do it. 00:20:22.000 --> 00:20:23.000 Whoo, slid. 00:20:24.000 --> 00:20:25.000 Special effects. 00:20:25.000 --> 00:20:26.000 Special effects. 00:20:27.000 --> 00:20:32.000 So if you cannot do it in client mode, it means you can only learn from other devices. 00:20:33.000 --> 00:20:34.000 So who can you learn from? 00:20:35.000 --> 00:20:37.000 You can learn from servers and you can learn from other clients. 00:20:38.000 --> 00:20:39.000 Hang on to that for just a moment. 00:20:40.000 --> 00:20:41.000 But learning from other servers, pretty straightforward, right? 00:20:42.000 --> 00:20:43.000 Server mode. 00:20:45.000 --> 00:20:47.000 Sends VTP messages. 00:20:48.000 --> 00:20:54.000 You receive VTP messages and you synchronize your database. 00:20:55.000 --> 00:20:56.000 You have 10 and 20. 00:20:57.000 --> 00:21:01.000 So you cannot configure them manually yourself here and teach others, but you can learn. 00:21:02.000 --> 00:21:10.000 Now, notice how I said that we can also send messages and we can learn from clients. 00:21:11.000 --> 00:21:12.000 So clients can teach other clients. 00:21:13.000 --> 00:21:14.000 So let me show you that here. 00:21:15.000 --> 00:21:18.000 In that particular case, what are we dealing with? 00:21:19.000 --> 00:21:20.000 We're dealing with, let's say this is a client. 00:21:20.000 --> 00:21:27.000 Well, once I learn this, I can send a VTP messages about what I know. 00:21:28.000 --> 00:21:36.000 So I may not be able to configure on this device, but once I know something, I can then send it down my trunk links. 00:21:37.000 --> 00:21:39.000 So that way there, you can learn about it as well. 00:21:40.000 --> 00:21:44.000 Now you might be saying, well, Raymond, this is kind of silly because you would have learned it this way anyways. 00:21:45.000 --> 00:21:51.000 I know, but you've got to think like six dimensionally here, right? 00:21:52.000 --> 00:21:56.000 You got to go back to a time that is prehistoric. 00:22:01.000 --> 00:22:04.000 When layer two was everywhere, folks. 00:22:05.000 --> 00:22:13.000 And when you look at it this way, these might be configured as my servers and everyone else is my clients. 00:22:14.000 --> 00:22:18.000 So that way there, these are the only two devices we can configure VLANs on. 00:22:19.000 --> 00:22:26.000 And then once we configure them, it gets sent out and then a client learns and then a client can tell the next client downstream. 00:22:27.000 --> 00:22:30.000 So it makes perfect sense when you look at it from this perspective. 00:22:31.000 --> 00:22:38.000 But when you look at it from our modern day networking perspective, where this is our layer three boundary right here, layer two, layer three boundary. 00:22:39.000 --> 00:22:40.000 And then when you go down from there, we've got what? 00:22:40.000 --> 00:22:43.000 We've got our access layer switches, layer two environment. 00:22:44.000 --> 00:22:51.000 When you've got the redundancy between all the different switches, learning from another client typically doesn't actually happen all that often. 00:22:52.000 --> 00:22:54.000 But server and client goes together. 00:22:55.000 --> 00:22:56.000 Keep that in mind. 00:22:57.000 --> 00:23:03.000 Transparent is essentially shutting off VTP. 00:23:04.000 --> 00:23:05.000 Not 100% shutting it off. 00:23:06.000 --> 00:23:07.000 That's what off is. 00:23:07.000 --> 00:23:10.000 But before off existed, all we had was transparent for shutting it off. 00:23:11.000 --> 00:23:12.000 So that's what we did. 00:23:12.000 --> 00:23:13.000 We didn't want to use VTP. 00:23:14.000 --> 00:23:15.000 You set it to transparent mode. 00:23:16.000 --> 00:23:19.000 Transparent mode says we can configure VLANs locally. 00:23:20.000 --> 00:23:25.000 So I can configure all the VLANs I want manually on all my switches. 00:23:27.000 --> 00:23:31.000 So I can configure VLANs here, I can configure VLANs here, here, here. 00:23:32.000 --> 00:23:35.000 But we are not going to tell the other switches about that. 00:23:35.000 --> 00:23:41.000 So if I'm in transparent mode and I configure VLAN 10, nobody's going to know that except for me, ASW1. 00:23:42.000 --> 00:23:46.000 If I configure VLAN 20 here and we're in transparent mode, I only know that. 00:23:47.000 --> 00:23:52.000 So transparent mode is about you manually configuring all of your VLANs on all of your different switches. 00:23:53.000 --> 00:24:03.000 And therefore, if you do receive a VTP message because you were in an environment, let's say you had, for example, server here, server here, transparent mode here. 00:24:04.000 --> 00:24:11.000 If you received a VTP message for some reason, then you would ignore it, but you would still forward it on. 00:24:12.000 --> 00:24:13.000 You would still forward it on. 00:24:15.000 --> 00:24:28.000 This allowed you to have switches in your environment that maybe weren't server or client mode, but still allowed that server to be between them or switch to be between them. 00:24:29.000 --> 00:24:41.000 But that becomes a challenge because if I had a server mode, transparent mode, and I have client mode, well, then if I have VLAN 10 here and I tell you about it, you ignore it, but you tell the client about it. 00:24:42.000 --> 00:24:43.000 Now the client knows about VLAN 10. 00:24:44.000 --> 00:24:47.000 And now if VLAN 10 traffic had to go this way, would it ever make it? 00:24:48.000 --> 00:24:50.000 No, because the transparent switch doesn't know about it. 00:24:51.000 --> 00:24:57.000 That's why you typically don't mix these two together, because I'd still have to go to this transparent mode switch and manually configure VLAN 10. 00:24:58.000 --> 00:25:01.000 So you could do it if you wanted to, but it's just more work for yourself. 00:25:02.000 --> 00:25:04.000 You might as well have server, client, client instead in that scenario. 00:25:05.000 --> 00:25:07.000 But if you had a need for that or a reason to do that, you could. 00:25:08.000 --> 00:25:10.000 That's why they allowed you to do that with transparent mode. 00:25:11.000 --> 00:25:19.000 It allowed you not to be part of the VTP sharing, but still forward that information, or not learn from the VTP sharing, but still forward that information. 00:25:20.000 --> 00:25:26.000 So the idea here is for you to recognize that on an exam, server mode, client mode, how do they behave? 00:25:26.000 --> 00:25:29.000 You can configure on a server, but not a client. 00:25:30.000 --> 00:25:31.000 But a server will teach a client. 00:25:32.000 --> 00:25:33.000 A server will teach a server. 00:25:34.000 --> 00:25:35.000 A client can teach a client everything it knows. 00:25:36.000 --> 00:25:42.000 Transparent mode will ignore all those messages that come in, and will not teach anything or anyone about anything. 00:25:43.000 --> 00:25:50.000 But if there's a transparent switch between a server switch and a server, or a client and a client, or a server and a client, the transparent switch will forward it. 00:25:51.000 --> 00:25:54.000 But if it's an off switch, then an off switch will not forward anything. 00:25:54.000 --> 00:26:00.000 So if this was off, and it received a message, it's sorry. 00:26:01.000 --> 00:26:02.000 It is dropped. 00:26:03.000 --> 00:26:06.000 Nothing's going to be sent to anybody else when it's all said and done. 00:26:07.000 --> 00:26:08.000 So these are your different modes. 00:26:09.000 --> 00:26:23.000 So if we go out to our live environment, if I type in VTP mode transparent, do show VLAN brief, you'll see that in this particular case, I have the original VLANs. 00:26:24.000 --> 00:26:39.000 So if I type in VLAN, let's type in VLAN 55, 56, 57, 58, exit out, show VLAN brief, you'll see that this device has the VLANs now that we just created, 56, 57, 58. 00:26:39.000 --> 00:26:54.000 But if we go over to somebody like DSW1 right now, look at our VLAN database, you'll see that they're not in there. 00:26:55.000 --> 00:26:56.000 Same thing, ASW1, ASW2, they're not there. 00:26:58.000 --> 00:26:59.000 Because this is a transparent mode switch. 00:27:00.000 --> 00:27:01.000 I don't care. 00:27:02.000 --> 00:27:03.000 I don't care about sharing my stuff with you. 00:27:04.000 --> 00:27:05.000 Go to DSW1 right now. 00:27:05.000 --> 00:27:06.000 Let's type in VLAN 777. 00:27:07.000 --> 00:27:08.000 Exit out of there. 00:27:09.000 --> 00:27:11.000 You'll see that ASW2 is going to learn about that. 00:27:23.000 --> 00:27:24.000 So we learn about it. 00:27:25.000 --> 00:27:26.000 777, there it is. 00:27:27.000 --> 00:27:29.000 But if you go to somebody like DSW2, you'll see DSW2 didn't learn about it. 00:27:30.000 --> 00:27:31.000 Why? 00:27:31.000 --> 00:27:32.000 Transparent mode. 00:27:32.000 --> 00:27:34.000 So you're not going to learn at all with transparent mode. 00:27:35.000 --> 00:27:42.000 So one of the safest ways to make sure that your VLAN database never gets corrupted is to use transparent mode, or use off. 00:27:43.000 --> 00:27:44.000 And then just manually configure your VLANs. 00:27:45.000 --> 00:27:51.000 Now there's a lot of organizations out there that will do server mode and client mode temporarily, 00:27:52.000 --> 00:27:57.000 where they do server client mode temporarily to share all the VLAN information they need to share with all the switches, 00:27:58.000 --> 00:28:03.000 and then they'll revert all their devices back to transparent mode at that point in time after that, or off. 00:28:04.000 --> 00:28:07.000 And so many different ways you can play around with this, it's up to you. 00:28:08.000 --> 00:28:11.000 But be mindful of how these operate for the certification exam. 00:28:12.000 --> 00:28:18.000 When it comes to sharing information, the decision as to whether you share it or not is based on something known as the configuration revision number. 00:28:19.000 --> 00:28:23.000 So if we type in, or sorry, not share it, learn it, and synchronize yourself. 00:28:24.000 --> 00:28:26.000 If we type in do show VTP status as an example, 00:28:27.000 --> 00:28:32.000 we'll see here that right now I have a configuration revision number of one on DSW1. 00:28:33.000 --> 00:28:37.000 And what does this configuration revision number do? 00:28:38.000 --> 00:28:39.000 It keeps track of all the VLAN changes. 00:28:40.000 --> 00:28:45.000 So for example, if we now type in something like VLAN 789, exit out of there, 00:28:46.000 --> 00:28:48.000 you're going to see the configuration revision number goes up by what? 00:28:49.000 --> 00:28:53.000 It's going to go up by one. 00:28:54.000 --> 00:28:56.000 So now you can see there's a configuration revision number of two. 00:28:56.000 --> 00:29:01.000 So type in VLAN 999, exit out of there. 00:29:02.000 --> 00:29:04.000 You'll see now it's a configuration revision number of three. 00:29:05.000 --> 00:29:11.000 Even going to like VLAN VTP or VLAN 999 as an example and typing, changing the name. 00:29:12.000 --> 00:29:14.000 Name, la la la la, good enough, okay. 00:29:15.000 --> 00:29:18.000 Exit out of there, that should change our configuration revision number as well. 00:29:19.000 --> 00:29:22.000 And you'll see now we're a configuration revision number of four. 00:29:22.000 --> 00:29:28.000 So what happens here is that when I send my VTP message out on the network 00:29:29.000 --> 00:29:30.000 because I'm in server mode right now, 00:29:31.000 --> 00:29:34.000 the configuration revision number that goes with this message is four. 00:29:35.000 --> 00:29:37.000 The existing VLAN is 13. 00:29:38.000 --> 00:29:41.000 And there's this message digest we have down here. 00:29:42.000 --> 00:29:45.000 So I'm sending you the VLAN information I have, 00:29:46.000 --> 00:29:52.000 but there's this message digest that is used to verify our authentication, 00:29:53.000 --> 00:29:54.000 our synchronization, all of that stuff. 00:29:55.000 --> 00:29:57.000 So remember, we've got a VTP password set up in this case. 00:29:58.000 --> 00:29:59.000 So I have an Encore domain name. 00:30:00.000 --> 00:30:01.000 I've got a VTP password of Cisco. 00:30:02.000 --> 00:30:03.000 We've got a configuration revision number of four. 00:30:04.000 --> 00:30:07.000 And what we do is we take all that information and all of our VLAN 00:30:08.000 --> 00:30:10.000 and we can go ahead and we can build or create this MD5 digest. 00:30:11.000 --> 00:30:15.000 So this is how we now synchronize and verify everything. 00:30:16.000 --> 00:30:18.000 So right now, for example, like somebody like ASW2 00:30:20.000 --> 00:30:22.000 has a configuration revision number of, let's say, two. 00:30:24.000 --> 00:30:30.000 So because it has a configuration revision number that is lower than DSW1, 00:30:31.000 --> 00:30:33.000 it now knows, hey, I've got to synchronize with that. 00:30:34.000 --> 00:30:35.000 So the higher the configuration revision number, 00:30:36.000 --> 00:30:37.000 the more trustworthy you are, 00:30:37.000 --> 00:30:38.000 meaning that you are the information. 00:30:39.000 --> 00:30:40.000 This is who we should be synchronizing with. 00:30:41.000 --> 00:30:42.000 So ASW1 gets this information. 00:30:43.000 --> 00:30:44.000 ASW2 gets this information. 00:30:45.000 --> 00:30:46.000 It's like, oh my gosh, my configuration revision number is lower than yours. 00:30:47.000 --> 00:30:48.000 I have to synchronize with you. 00:30:49.000 --> 00:30:50.000 That is what determines synchronization. 00:30:51.000 --> 00:30:53.000 And now based on things like, are we in the same domain? 00:30:54.000 --> 00:30:55.000 Do we have the same password? 00:30:56.000 --> 00:31:02.000 Can I generate the exact same message digest as you using that information 00:31:03.000 --> 00:31:05.000 and the VLANs and the configuration revision number? 00:31:05.000 --> 00:31:07.000 If so, then I'm going to go ahead and synchronize with you. 00:31:08.000 --> 00:31:09.000 If not, then I'm not going to synchronize with you. 00:31:10.000 --> 00:31:12.000 So because all of that is true in this particular case, 00:31:15.000 --> 00:31:16.000 when we look at somebody like ASW2, 00:31:17.000 --> 00:31:19.000 you'll see that we've successfully synchronized. 00:31:20.000 --> 00:31:21.000 I've got a configuration revision number of four. 00:31:22.000 --> 00:31:23.000 So does DSW1. 00:31:24.000 --> 00:31:25.000 Number of VLANs, 13. 00:31:26.000 --> 00:31:27.000 Same as DSW1. 00:31:28.000 --> 00:31:29.000 Look at the message digest. 00:31:30.000 --> 00:31:31.000 It's the same. 00:31:32.000 --> 00:31:33.000 You see how it's the same? 00:31:33.000 --> 00:31:34.000 Same. 00:31:35.000 --> 00:31:36.000 So let's now add another VLAN. 00:31:37.000 --> 00:31:39.000 VLAN 945. 00:31:40.000 --> 00:31:41.000 Exit out of there. 00:31:42.000 --> 00:31:43.000 Come back. 00:31:44.000 --> 00:31:45.000 So we'll go to VTP status again. 00:31:46.000 --> 00:31:47.000 You're going to see now, this has changed. 00:31:48.000 --> 00:31:49.000 This has changed. 00:31:50.000 --> 00:31:51.000 This has changed. 00:31:52.000 --> 00:31:53.000 So if we go back to ASW2, this is what was there before on ASW2. 00:31:54.000 --> 00:31:55.000 Now look at all this. 00:31:56.000 --> 00:31:57.000 It's changed. 00:31:58.000 --> 00:31:59.000 So when this message comes out from DSW1, 00:32:00.000 --> 00:32:01.000 ASW2 is going to have to take its domain name, 00:32:01.000 --> 00:32:04.000 its current configuration revision number is four, 00:32:05.000 --> 00:32:06.000 but it sees that there's a five on DSW1, 00:32:07.000 --> 00:32:08.000 so it's going to use five in this particular case. 00:32:09.000 --> 00:32:10.000 And the number of VLANs we have, 00:32:11.000 --> 00:32:13.000 build its own message digest from that. 00:32:14.000 --> 00:32:15.000 And in the end, if it gets the same value, 00:32:16.000 --> 00:32:17.000 it synchronizes. 00:32:18.000 --> 00:32:19.000 If not, then it's not going to synchronize. 00:32:20.000 --> 00:32:21.000 And in this case, you'll see that it got this value, 00:32:22.000 --> 00:32:23.000 which is obviously different than that one before. 00:32:24.000 --> 00:32:25.000 And is it the same, though, as DSW1? 00:32:26.000 --> 00:32:27.000 Yes, it is. 00:32:28.000 --> 00:32:29.000 So I successfully synchronized with you. 00:32:29.000 --> 00:32:31.000 So all of that comes into the synchronization process. 00:32:32.000 --> 00:32:33.000 And so this happens with servers and clients. 00:32:34.000 --> 00:32:35.000 It doesn't happen with transparent. 00:32:36.000 --> 00:32:37.000 So if we go over to somebody like DSW2 right now 00:32:38.000 --> 00:32:39.000 who's in transparent mode, 00:32:40.000 --> 00:32:42.000 and we type in show VTP status, 00:32:43.000 --> 00:32:45.000 all of that stuff that happened doesn't matter here. 00:32:46.000 --> 00:32:47.000 So every time DSW2 got the VTP messages, 00:32:48.000 --> 00:32:49.000 it totally ignored them. 00:32:50.000 --> 00:32:51.000 Look at the configuration revision number. 00:32:52.000 --> 00:32:53.000 It's zero. It doesn't even care. 00:32:54.000 --> 00:32:55.000 It doesn't even care. 00:32:56.000 --> 00:32:57.000 So a lot of people ask me, 00:32:57.000 --> 00:32:58.000 well, though, Raymond, 00:32:59.000 --> 00:33:00.000 is the configuration number going to change 00:33:01.000 --> 00:33:02.000 if we create VLANs? Nope. 00:33:06.000 --> 00:33:07.000 Oops, wrong button again. 00:33:09.000 --> 00:33:10.000 Nope, still zero. 00:33:11.000 --> 00:33:12.000 Always zero. Always zero. 00:33:13.000 --> 00:33:14.000 Always zero. 00:33:15.000 --> 00:33:16.000 Now, notice the messages I just did change 00:33:17.000 --> 00:33:18.000 because it still keeps track of that. 00:33:19.000 --> 00:33:20.000 And then the next question is, okay, 00:33:21.000 --> 00:33:22.000 so when you're in transparent mode, 00:33:23.000 --> 00:33:24.000 does the domain name matter? 00:33:25.000 --> 00:33:26.000 Do you even need one? Absolutely. 00:33:27.000 --> 00:33:28.000 If you're in transparent mode, if you're null, 00:33:29.000 --> 00:33:30.000 although you won't join a domain 00:33:31.000 --> 00:33:32.000 if you are in transparent mode and null, 00:33:33.000 --> 00:33:34.000 if your device ever accidentally gets changed back 00:33:35.000 --> 00:33:36.000 to server or client mode, 00:33:37.000 --> 00:33:38.000 accidentally or on purpose, 00:33:39.000 --> 00:33:40.000 then the first VTP message it receives, 00:33:41.000 --> 00:33:42.000 and it will get one pretty fast, 00:33:43.000 --> 00:33:44.000 it'll join that domain. 00:33:45.000 --> 00:33:46.000 It could just destroy everything on you. 00:33:47.000 --> 00:33:48.000 So, yes, a domain name should always be configured. 00:33:49.000 --> 00:33:50.000 And then what about version? 00:33:51.000 --> 00:33:53.000 So version one is causing a lot of problems for us, 00:33:54.000 --> 00:33:55.000 especially if we're in server or client mode 00:33:55.000 --> 00:33:58.000 because version one was designed way back in the day 00:33:59.000 --> 00:34:00.000 when we were dealing with just ISLs 00:34:01.000 --> 00:34:02.000 before 802.1Q was created, 00:34:03.000 --> 00:34:04.000 supported only normal range VLANs, 00:34:05.000 --> 00:34:07.000 VLANs one through 1005, as we talked about before. 00:34:08.000 --> 00:34:09.000 So, and that is for what? 00:34:10.000 --> 00:34:11.000 Server and client mode. 00:34:12.000 --> 00:34:13.000 Now, transparent mode, though, 00:34:14.000 --> 00:34:15.000 if you go to transparent mode, 00:34:16.000 --> 00:34:17.000 you can support all the VLANs, 4096. 00:34:18.000 --> 00:34:22.000 So this only applies to server and client mode, 00:34:23.000 --> 00:34:24.000 whereas in transparent mode, 00:34:25.000 --> 00:34:27.000 you get all 4096 VLANs supported. 00:34:28.000 --> 00:34:30.000 This added support for token ring networks, 00:34:31.000 --> 00:34:32.000 so really not even valuable today at all. 00:34:33.000 --> 00:34:34.000 You could just probably forget about version two. 00:34:35.000 --> 00:34:36.000 Version three, though, 00:34:37.000 --> 00:34:39.000 with server mode, client mode, off, transparent, 00:34:40.000 --> 00:34:41.000 it doesn't matter. 00:34:42.000 --> 00:34:43.000 It supports the entire range of VLANs. 00:34:44.000 --> 00:34:45.000 And version three also supports enhanced authentication. 00:34:46.000 --> 00:34:47.000 It supports private VLAN information, 00:34:48.000 --> 00:34:49.000 supports the propagation 00:34:50.000 --> 00:34:51.000 of multiple Spanish protocol information. 00:34:52.000 --> 00:34:53.000 And on top of that, 00:34:53.000 --> 00:34:54.000 it supports the concept of a primary, 00:34:55.000 --> 00:34:59.000 primary server and secondary servers. 00:35:00.000 --> 00:35:01.000 What does that mean? 00:35:02.000 --> 00:35:04.000 It means you're going to promote one of your switches 00:35:05.000 --> 00:35:06.000 to be the primary server. 00:35:07.000 --> 00:35:08.000 So let's make this one the primary server. 00:35:09.000 --> 00:35:10.000 What does that mean? 00:35:11.000 --> 00:35:13.000 It means no matter what happens now in this environment, 00:35:14.000 --> 00:35:15.000 your switches will not listen to anybody 00:35:16.000 --> 00:35:17.000 but the primary server. 00:35:18.000 --> 00:35:19.000 That's right. 00:35:20.000 --> 00:35:21.000 So even if some rogue switch comes along, 00:35:21.000 --> 00:35:23.000 rogue switch comes along, 00:35:24.000 --> 00:35:26.000 and manages to form a trunk 00:35:27.000 --> 00:35:28.000 and send VLAN information, 00:35:29.000 --> 00:35:30.000 you ignore it. 00:35:31.000 --> 00:35:32.000 You ignore it. 00:35:33.000 --> 00:35:34.000 It doesn't matter. 00:35:35.000 --> 00:35:36.000 It doesn't matter because you don't listen to anybody 00:35:37.000 --> 00:35:38.000 but the primary server in that particular environment. 00:35:39.000 --> 00:35:40.000 So that is a recommendation to use version three today 00:35:41.000 --> 00:35:42.000 if you're using VTP. 00:35:43.000 --> 00:35:44.000 So that's what I encourage you to do. 00:35:45.000 --> 00:35:46.000 You can't even use VTP version three 00:35:47.000 --> 00:35:48.000 unless you create a domain name. 00:35:49.000 --> 00:35:50.000 So VTP version three, domain name, 00:35:51.000 --> 00:35:52.000 is preferred. 00:35:53.000 --> 00:35:54.000 And regardless of whether you're using server, 00:35:55.000 --> 00:35:57.000 client, off, or transparent, 00:35:58.000 --> 00:35:59.000 whatever you choose doesn't matter, 00:36:00.000 --> 00:36:01.000 but go with version three. 00:36:02.000 --> 00:36:03.000 Highly recommend it. 00:36:04.000 --> 00:36:05.000 And our last discussion here is on something called 00:36:06.000 --> 00:36:07.000 VTP pruning. 00:36:08.000 --> 00:36:09.000 Now VTP pruning only works with server and client mode. 00:36:10.000 --> 00:36:11.000 Let me repeat that. 00:36:12.000 --> 00:36:13.000 VTP pruning only works with server and client mode. 00:36:14.000 --> 00:36:15.000 Let me repeat that. 00:36:16.000 --> 00:36:17.000 VTP pruning only works with server and client mode. 00:36:18.000 --> 00:36:19.000 It does not work with transparent mode. 00:36:20.000 --> 00:36:21.000 Or off. 00:36:23.000 --> 00:36:24.000 So what does that mean? 00:36:25.000 --> 00:36:26.000 It means that if you want to do VTP pruning 00:36:27.000 --> 00:36:28.000 but you're in transparent mode or off, 00:36:29.000 --> 00:36:30.000 you can't. 00:36:31.000 --> 00:36:32.000 You're going to have to do something else. 00:36:33.000 --> 00:36:34.000 Now is there something else you could use? 00:36:35.000 --> 00:36:36.000 Absolutely. 00:36:36.000 --> 00:36:37.000 Look at what it says here. 00:36:38.000 --> 00:36:39.000 VTP pruning says add or remove VLANs 00:36:40.000 --> 00:36:41.000 off a trunk dynamically. 00:36:42.000 --> 00:36:43.000 Add or remove VLANs off a trunk dynamically. 00:36:44.000 --> 00:36:45.000 Wait, wait, wait. 00:36:46.000 --> 00:36:47.000 We talked about something like that earlier today, 00:36:47.000 --> 00:36:48.000 we talked about that. 00:36:49.000 --> 00:36:50.000 We talked about it with our trunk filtering. 00:36:51.000 --> 00:36:52.000 That's where we talked about it. 00:36:53.000 --> 00:36:54.000 Remember this discussion, folks? 00:36:55.000 --> 00:36:56.000 We talked about using filters 00:36:57.000 --> 00:36:58.000 to control which VLANs are allowed on a trunk link. 00:36:59.000 --> 00:37:00.000 That's what VTP pruning does. 00:37:01.000 --> 00:37:02.000 That's what VTP pruning does. 00:37:03.000 --> 00:37:04.000 But it does it dynamically for you 00:37:05.000 --> 00:37:06.000 instead of you having to do it manually. 00:37:07.000 --> 00:37:08.000 But it only works if you're what? 00:37:09.000 --> 00:37:10.000 Server or client mode. 00:37:11.000 --> 00:37:12.000 Always remember that for the certification exam. 00:37:13.000 --> 00:37:14.000 Why do I say that? 00:37:15.000 --> 00:37:16.000 I say that because if I gave you this output 00:37:17.000 --> 00:37:18.000 and I said, hey, I want you to prune VLANs 00:37:19.000 --> 00:37:20.000 off the trunk link. 00:37:21.000 --> 00:37:22.000 Let me repeat that. 00:37:23.000 --> 00:37:24.000 I want you to prune your VLANs off the trunk link. 00:37:25.000 --> 00:37:26.000 Look at the word I used, prune. 00:37:27.000 --> 00:37:28.000 Can you actually use it? 00:37:29.000 --> 00:37:30.000 The answer is no. 00:37:31.000 --> 00:37:32.000 You would have to filter it instead. 00:37:33.000 --> 00:37:34.000 Meaning, don't pick a pruning answer. 00:37:35.000 --> 00:37:36.000 Pick a filtering answer. 00:37:37.000 --> 00:37:38.000 That's the difference. 00:37:39.000 --> 00:37:40.000 But if I showed you this output 00:37:41.000 --> 00:37:42.000 and I said, hey, I want you to prune VLANs 00:37:43.000 --> 00:37:44.000 that you don't need off your trunk link, 00:37:45.000 --> 00:37:46.000 then you can use VTP pruning. 00:37:47.000 --> 00:37:48.000 This is server mode or client mode. 00:37:49.000 --> 00:37:50.000 That is what you need to consider 00:37:51.000 --> 00:37:53.000 about that scenario in case it comes up. 00:37:54.000 --> 00:37:55.000 Be aware of that. 00:37:56.000 --> 00:37:57.000 How does VTP pruning work? 00:37:58.000 --> 00:37:59.000 How do you turn it on? 00:38:00.000 --> 00:38:01.000 If you saw client mode, 00:38:02.000 --> 00:38:03.000 you can't turn it on on a client mode device. 00:38:04.000 --> 00:38:06.000 You can only turn it on on a server mode device. 00:38:07.000 --> 00:38:08.000 Here's a server mode device. 00:38:09.000 --> 00:38:10.000 Here's a server mode. 00:38:11.000 --> 00:38:12.000 Let's say this is client and this is client. 00:38:13.000 --> 00:38:14.000 I would go to any one of my server mode devices, 00:38:15.000 --> 00:38:16.000 just one of them, 00:38:17.000 --> 00:38:18.000 and turn on VTP pruning. 00:38:19.000 --> 00:38:20.000 When I type in VTP pruning on that device, 00:38:21.000 --> 00:38:24.000 this here would change from disabled to enabled. 00:38:25.000 --> 00:38:26.000 Then I generate a VTP message 00:38:27.000 --> 00:38:31.000 and I send it to everyone in the VTP domain 00:38:32.000 --> 00:38:33.000 and I tell them, turn on VTP pruning, 00:38:34.000 --> 00:38:35.000 and they will do that. 00:38:36.000 --> 00:38:37.000 You do it once on a server. 00:38:38.000 --> 00:38:39.000 If this was client mode here 00:38:40.000 --> 00:38:41.000 and they were asking you to turn on VTP pruning, 00:38:42.000 --> 00:38:43.000 you would have to look to an answer option 00:38:44.000 --> 00:38:45.000 that says go to one of the servers 00:38:45.000 --> 00:38:47.000 and type in the VTP pruning command. 00:38:48.000 --> 00:38:49.000 If it's a server, 00:38:50.000 --> 00:38:51.000 then just type in the VTP pruning command. 00:38:52.000 --> 00:38:53.000 It would magically happen on all the rest of them. 00:38:54.000 --> 00:38:55.000 That's the first thing I want you to remember. 00:38:56.000 --> 00:38:57.000 Second thing I want you to remember is, 00:38:58.000 --> 00:39:00.000 again, it doesn't work on transparent mode devices. 00:39:01.000 --> 00:39:02.000 What does that mean? 00:39:03.000 --> 00:39:04.000 It means that this particular switch, 00:39:05.000 --> 00:39:06.000 if it was transparent mode, 00:39:07.000 --> 00:39:08.000 you wouldn't be able to turn on VTP pruning there. 00:39:09.000 --> 00:39:10.000 What would you do? 00:39:11.000 --> 00:39:12.000 You would create a manual filter list 00:39:13.000 --> 00:39:14.000 like we talked about in our trunking discussion. 00:39:15.000 --> 00:39:16.000 That way you know what you need to know. 00:39:17.000 --> 00:39:18.000 That is VTP, folks. 00:39:22.000 --> 00:39:23.000 Again, probably not a big part of the exam, 00:39:24.000 --> 00:39:25.000 but if you get two questions 00:39:26.000 --> 00:39:27.000 that either use it as a distractor 00:39:28.000 --> 00:39:29.000 or as the real answer, 00:39:30.000 --> 00:39:31.000 at least you can deal with it now 00:39:32.000 --> 00:39:33.000 and you'll get full points that you need to get.