VLAN Trunking Protocol VTP
Oftentimes, it can be a burden to manage a large L2 network with lots of VLANs spread around different switches. To ease this burden, Cisco developed VTP. VTP allows an administrator to configure a VLAN in one location and have its properties automatically propagated to other switches inside the VTP domain. VTP uses a destination MAC address of 0100.0ccc.cccc and a SNAP protocol type of 0x2003. VTP uses th notion of a client and a server to determine which devices have rights to propagate VLAN information in what direction.
I'll be honest, having my VLAN information automatically propagate to my different switches doesn't fill the security part of my brain with glee. Start by strongly considering whether VTP is going to save you time or cause you headaches. If all your VLANs have similar security levels, perhaps VTP could be helpfi to you. But if instead you have different security levels on your VLANs and certain VLANs should only ex on certain switches, it is probably easier, and safer, to manually configure each VLAN where you need it
If you must use VTP, be sure to use it with the MD5 digest option. This adds a 16-byte MD5 digest of th VTP packet combined with a password and makes it much harder for an attacker to send you bogus VTP information causing your VLANs to be reconfigured. Without the MD5 authentication, an attacker could I disguised as a VTP server with all VLANs deleted. This could cause all switches in your entire network to remove their VLAN configuration. Not a good thing for security at all! The syntax for configuring a VTP password is as follows:
CatOS> (enable) set vtp [domain domain name]
[mode {client | server | transparent | off}] [passwd passwd] [pruning {enable | disable}] [v2 {enable | disable}] IOS(config)#vtp password password-value
Continue reading here: VLAN Query Protocol VQP
Was this article helpful?