All language subtitles for 17 - Switching - Understanding VTP and 802.1q-eng

>> Deeper down the rabbit hole we go
with VLANs as we unpacked VTP and 802.1Q.

In the last Nugget, I gave you kind of
the overview like this what VLANs are,

this is why they're great, this is
some examples of how we can use them,

now I'd like to unpack the details of it.

So, how to look at trunks
and how they really work

and that there's really a secret
sauce behind them called 802.1Q.

We'll look at a concept of the Native
VLAN and then finally, look at VTP,

how it can help or destroy your entire network.

Okay, let's pull a little
review from the last Nugget.

Trunking, what is it?

Well, trunking is the ability to connect
multiple switches together and allow your VLANs

to seamlessly go across your
entire campus fabric.

Man, that statement was made for a
marketing magazine or something like that.

That sounded so good, I can't
even say it again if I try.

But, if I connect multiple switches together
like let's add switch C and switch D together,

well, it gives me the ability to add computers,
and devices, and wireless access points,

and printers and whatever else, whatever
widgets I'd like to, all around the campus

and allow these VLANs to span that direction.

So, for instance, let's say VLAN 2, which I
have there as that little orange-ish computer.

VLAN 2 might be the sales VLAN.

So all the sales people are a member of that.

So I can now add sales people down here and
add them as well to VLAN 2 and maybe this--

this is-- this wireless access
point is actually for VLAN 3

because only the executive team
get wireless access, or whatever.

You get the point.

We can stretch our VLANs all around our
company through this concept of trunking.

Now what trunking does is tag,
remember I said in the last Nugget,

a better word for is tagging, tag each packet
that sent across the wire, across those links

that connect the switches, with
this special little 4-byte field.

Now, there are two forms
of trunking, one is 802.1Q.

I'm hesitant even say this
nowadays but you may see it.

You may encounter it somewhere
sometime whether it be exam,

whether it be real world, you might run into it.

There is another one called
ISL, Inter-Switch Link.

So these are two different languages
that you can use for tagging packets.

Now, Cisco was first to the game with VLAN.

Long before there was a real standard or
at least I should say a good standard,

Cisco came out with something
called Inter-Switch Link.

Now that worked and it allowed you to tag
your packets with specific VLAN information

and send it across, but anytime
you say, Cisco made it,

that means it only works for Cisco switches.

802.1Q, which was the eventual
standard, is the replacement for ISL.

Now, this is industry standard--
in-- in-- well, you get the point,

industry standard to where any vendor
can create a switch and use 802.1Q.

So, I could-- you know, I've got switch A
which might be a Cisco, might be a Cisco,

maybe bring in switch F over here
with-- it's some hidden brand over here.

We don't know, but as long as it's a
managed switch, it will support 802.1Q

and it will do VLANs and now
be able to integrate and speak

that trunking language with my Cisco switches.

So let's dig a little bit deeper.

Inside of this little 4-byte tag is a-- is
VLAN data and this is where it will be 1

of 4,096 different values so let
it know which VLAN it belongs to.

And then next to that is something known as the
priority, or if you dig a little bit deeper,

it's not part of this series but that
is actually called class of service.

So switches can do quality of service as well.

So I can put in this header information.

I can put little tags that say, "Oh,
these traffic is really important.

You're a level-5 traffic.

Whereas this traffic, eh,
it's not that important

and you're a level 1 or a level 0 traffic."

So, these are all known as the
CoS or Class of Service bits.

If you ever decided diving to
CCNP, or get into Voice over IP

or one of the more advanced tracks,
they'll totally explain that.

For now, we don't care.

[laughs] All eyes are on that VLAN tag which is
sitting in the header and it passes all of that

between switches by embedding
it into each frame.

Now, keep in mind, this is a trunking thing.

This is only on the links between your
switches, VLAN tags are always removed

when we're sending data to
the computer themselves.

Partnered with the concept of trunking
is the idea of the Native VLAN.

Trunks send tagged information, right?

Let me go with the simple view here.

We got a couple of switches, let's say we've
got three computers up here that are all--

you know, these guys are a member of
VLAN 2, this guy is a member of VLAN 3,

and then down here I've got one
computer that's a member of VLAN 2

and one computer member of VLAN 3.

So, if this is a trunk, it's going
to send tagged information across.

So as VLAN 3 sends a broadcast, it will come
down here and go, "Oh, let's put a little,

you know, shim on the header there.

We've got VLAN 3 tag, that's now we
officially know, an 802.1Q tag on the header.

So when this guy gets it, he
goes, "Oh, you belong to VLAN 3."

Strips off that little tag and then
sends it to all the VLAN 3 devices.

That's what trunks do.

Now, the question of this Native
VLAN comes in when we say, "Well,

what if I need to send something
between these guys that is not tagged?"

And you might look at the picture and say,
"Well, look at the picture what wouldn't be tag.

I mean, we've got two over here and two over
here and three over here and three over here,

so you would have tags of two
and tags of three [inaudible],

why would you send something that's not tagged?"

Well, there are management protocols
that run behind the scenes on switches.

Well, like one of them we know is
Telnet, another one might be SSH.

So, maybe I'm sitting here plugged in to the
console port of the switch, this switch is,

you know, 300 feet down the
hall and then like, well,

I don't want to go walk down
the hall with my laptop.

That's a far walk.

I'm sitting in my chair, I'm kind of cozy.

I just want a Telnet from this
switch down to this switch, right?

Well, if I'm Telnetting from this switch to
this switch, what VLAN does that belong on?

None, really, I mean, it's whatever
VLAN this switch management interface is

on which is probably VLAN 1.

So, it's going to send that across untagged,

or there's another protocol we
haven't talk about yet called CDP.

It's a discovery protocol.

It's kind of neat because Cisco devices will
send each other these little discovery messages

where they're like, "Oh, I see you
my little friends, Cisco device.

I'm going to add you to a table."

So, an administrator at any point can type
in a command called Show CDP Neighbors

and they can see all the Cisco devices
around them, all of the devices

that are attached to whatever device they're on.

Well, in order for CDP to work, these
guys have to send like little probes,

little hellos saying, "Hey, I'm running CDP.

This is me.

This is-- I'm a switch did you know who-- ."

All of that stuff is running on the Native VLAN.

It doesn't really belong to a VLAN so
much as it's just traffic that needs

to pass from one switch to another.

It's considered untagged traffic.

This concept originally came about in long,
long ago when switches were so expensive,

people were like, man, we can't
afford many of these things.

Let's put hubs in the middle of our network so
that we can kind of, you know, balance the cost.

So we would have some switches going
through hubs to reach other switches.

Well, and to those hubs, we would plug in
computers and these switches would have trunks

to each other, they'd be tagging packets,

so VLAN 15 ends up on VLAN 15
and all that kind of stuff.

But the question became, well, what happens when
this computer comes in on that port and says,

"Hey, I want to talk to something.

What VLAN is it on?

The Native VLAN.

If a trunk receives data that
does not have a tag on it,

it will automagically become
part of the Native VLAN.

Nowadays-- I mean, nowadays, burn that model.

Nobody does that anymore, that's
like-- you know, that's heresy.

Why would you put a hub in
the middle of your network?

But nowadays, we use this
concept for things like this.

For example, best practice says, "I
want to put my IP phones on a VLAN."

Let's put them on VLAN 15 which
is separate from the computer

that it's plugged into, maybe
this guy is on VLAN 10.

Why is that a best practice?

Because it's scary.

If you have your computer and your phone on
the same VLAN and somebody pulls out Wireshark,

Wireshark has the ability to capture voice
packets and reassemble them into audio files.

[laugh]s So back in the day, you know,
people would have those little butt sets

that they would have on their
waist with the alligator clips.

You know, that they would clip on
to the wires and be able to kind

of tap phone conversations
and hear what's going on.

I mean phone text still have them today.

I shouldn't say back in the
day, they're still around.

Now, you can do that without
needing any alligator clips.

You can open Wireshark and I capture the data.

So Cisco is like, "Whoa, let's keep this
guy on a separate VLAN than this guy.

But then we'll run in the
problem, "Well, how do you that?

Because normal ports are
only a member of one VLAN."

And then, you know, if this guy is sending
traffic, I mean, how do I differentiate

between him sending traffic and him
because they're coming in the same port.

Well, that was where that concept
of the Native VLAN came in.

Now, what I'm about to tell you is if you
were to tell this to Cisco, they'll be like,

"No, no, no, that's not how we do it.

It's not. It's not."

Because it's actually a security flaw, if you
will, but it was the original way they do it

and it's still kind of the way
they do it, but let me explain

and that we can unpack all of
the politics behind it later.

The way that we can make this work is to
configure this port as a type of trunk.

Now, a trunk will send tagged
packets which IP phones understand.

So I can say, on this trunk, I'm going
to have VLAN 15 be the tagged VLAN.

Now that's good because this
phone understands tags.

Cisco IP phones, you pull them out of box,
they're like, "I speak the language of 802.1Q.

I speak tags."

So, as I'm speaking on the phone, I'm
saying, "Hello everybody" on the phone.

It's sending packets and it's automatically
putting them with little tag of 15.

So the switch goes, "Okay, you're coming from
a phone, I'm going to put you on VLAN 15."

Now the computer, no idea what a VLAN even is.

Computers do not know the concept of VLANs.

They know the concept of surfing the web.

They know the concept of transferring files.

So they just have an IP address,
they're just sending data.

So they're coming in without any VLAN tags.

Hmm, that rings a bell.

If they don't have any VLAN
tags, then what are they on?

The Native VLAN.

So what you would configure
this for is it would be a trunk

and I would set it out for a Native VLAN of 10.

So when this computer starts
sending data, it doesn't have a tag,

it says, "Well, you must be on VLAN 10."

So that's kind of how we
apply that concept today.

Now, Cisco has new and improved
ways of doing this kind of thing.

So the reason I emphasize that is because they
really make a point of saying it's not a trunk.

It's a tagged access port, but it
really is kind of the same thing.

So for now, just for the concept, that's
what the Native VLAN is all about.

So, why am I talking about this?

You know, it's kind of like, okay,
good I get it, what's the point?

Well, the point-- I found out-- so,
this has been bugging me for so long.

You see how my circles are
kind of like blobby, see that.

I found out that my little drawing program
here converts my-- when I clear it like that,

when I clear-- it converts my pen to like a gel
pen and I finally figured out, check this out.

Watch the blobby.

Watch it. Bam!

Isn't that so much cleaner?

Come on, the difference, gel pen, oh ugly.

Default, oh, much better.

So, I finally figured that out.

I was very excited.

But why am I telling you this
concept of the Native VLAN?

The reason why is because it's
dangerous if you mismatch them.

So, what I mean is this.

Let's say we've got two switches and
by default, the Native VLAN is 1.

That's just how it is, but you can change that.

Let's say on one side, I make the
Native VLAN 10 and on the other side,

I make the Native VLAN 20, right?

Well, that poses a problem.

It's going to break something,
likely, if I do that.

The switches will start yelling at you.

They'll send you messages on the console port
like mad being like, "Native VLAN mismatch.

Don't do this.

Something is very wrong."

But what ends up happening is devices that are
on VLAN 10, maybe they're the accounting devices

and devices that are on VLAN 20,
maybe they're the sales devices end

up merging together into this big blob VLAN.

So here's what happens.

This guy sends some data to the other
side, the switches like, "Oh, okay,

you're trying to reach, we'll say, you know,
device X over here," and he's in VLAN 20.

But as soon as it hits that trunk
port, it goes, "Oh, wait a sec,

wait a sec, VLAN 20 is my Native VLAN.

That means VLAN 20 doesn't have any tags.

There're no tags in there."

So rather than doing what trunks
normally do which is stick a little tag

on that packet saying VLAN 20 is-- you know,
is tagged on here, so this switch gets in,

he's like, "Oh, you belong to VLAN 20."

He goes, "Oh, well that's my Native
VLAN so I'm going to strip the tag off.

There's going to be no tag.

I'm just going to send it untagged 'cause
remember, Native VLAN equals untagged."

So, on the other side, I've
got a Native VLAN of 10.

So it comes in and it assumes
that I'm on VLAN 10.

And so, so this untagged traffic went
out on 20 came in it's like, "Oh,

well my Native VLAN is 10 so now I'm on 10."

Is it supposed to do that?

No, but it's how it's configured.

That's called the Native VLAN mismatch.

And what it does is undo a lot of your security
boundaries to where this guy can now get

to this guy, and he's not supposed to.

Because-- and same thing happens on this side,
if I've got computer and VLAN 10 over here.

When he sends it, he's going
to be like, "Oh, VLAN 10,

that's my Native so I'll send it untagged
and then it comes in on this guy as VLAN 20."

So, my point is, if you're configuring trunks
which we're going to do in the next Nugget,

you want to make sure that the Native
VLAN matches between both sides.

Now, let's get back to Cisco.

Cisco had a really good idea.

Remember I said, they were
first to the game with VLANs,

they came out with this protocol called ISL.

We don't use it anymore nowadays,
but it was great, great for its time.

Well, way back then, Cisco, you know,
was kind of looking at the VLAN standard

as it was emerging and they're like,
"We can do something really cool.

We're going to come up with
this protocol called VTP."

Now, first of, the name will mess you up,

[laughs] it stands for the
VLAN Trunking Protocol.

But, and I'm going to say it
and I'm going to say it twice

because I want it to stick in your head.

It is not a trunking protocol, okay?

You get it?

The VLAN Trunking Protocol
is not a trunking protocol.

There are only two trunking protocols out there.

One of them has gone away.

One is ISL, the other is 802.1Q.

Those are the two protocols that can tag traffic

so that switches know what
VLAN it belongs to, that's it.

So the VLAN Trunking Protocol,
what, is not a trunking protocol.

It should've been called the VLAN Replication
Protocol, that's my humble opinion.

But nonetheless, here's what Cisco's goal was
and it really was, it really was a good idea.

You know why I'm saying this, that I'm going to
have this kicker at the end and I'm like, yeah,

and it's not a good idea
anymore and you're right.

So, VTP was a great idea because what would
happen is it would save you configuration work

and make your network totally consistent.

So, the way VTP works is you would
link up all your switches with trunks.

So we've got 802.1Q running everywhere here.

This is our trunking, right?

8021Q Trunk, that bridge
[inaudible] switch together

and I would go in and I would create a VLAN.

Let's say VLAN 10 and I name it,
that's one of the things you can do.

We'll say name sales.

Now VTP immediately goes, "Oh,
I'm going to update my database."

It looks like they made a change,

all the switches by the way start
their database at Revision 0.

So it's Revision 0.

And now it goes, "Okay, they made a change.

They added VLAN 10.

We are at Rev 1."

He sends an announcement saying, "Rev
1," this guy is like, "Oh, sweet Rev 1.

I want Rev 1.

Rev 1, Rev 1."

So all these switches are getting this little
revision and they go, "What's to be revised?"

My VLAN database.

So they now all have VLAN 10, VLAN 10.

So, it saves you the time, 'cause
normally, I have to go switch by switch,

by switch and add in VLAN 10 and add
in and name it and give it a name.

I mean, I know I'm making it sound
like a lot of work, and it kind of is.

But VTP just makes it that much easier
and then they go in there and say, "Well,

I'm going to add VLAN 20,
maybe VLAN 20 is marketing."

And it goes, "Okay, Rev 2, Rev 2, Rev 2, Rev 2."

I mean, it's almost instantaneous.

It's like snap your fingers, bam!

VLAN 20 appears on all the switches.

And now, all you have to do is start assigning
the ports to it, so it knows which ports belong

in which VLANS, but it saves you
a big part of your configuration.

So that's really cool.

Here's where the problem comes in.

I'm talking about all these, right?

Let's say that you go out on eBay after
this discussion like, "I got to do this.

I'm going to go on eBay,
I'm going to buy a switch."

You look at the description and
it says, you know, "Cisco 3550.

You know, the company went out of business, used
it for eight years, still works great, you know,

their loss, your gain, buy it now 50 dollars."

And you're like, "Fifty dollars, that's great."

So you buy it now, bam!

You get the switch in the mail.

You go to log on and you find out it has the
company's old configuration on it, that's cool.

Because it's very easy to do
password recovery in a Cisco switch,

and I love when I get stuff off eBay
where it has old configurations 'cause I

like seeing how people's network are setup.

I'm like, "Oh, oh."

You know, and I just like seeing that.

So, you kind of-- you look at it,
you're like, "Man, this is really cool.

Oh well, okay let's erase it."

So, you erased the configuration on the switch.

You do, right erase is one of
the ways to do it, quick way.

Reboot, okay, I'm back to a clean config.

Okay, I'm playing around at
home doing my thing, right?

And all a sudden I'm like,
"Ah, I got to go to work."

And then the thought hits your mind.

You know what, I have a lot of downtime at work.

Maybe I can bring my switch to work that I
got off eBay and just do a little studying.

And so, you're like, "That's a great idea."

So you bring your switch to work and you
configure, "You know, man, this is great",

and all of a sudden, it hits you again.

You're like, "You know what, I've got this
home switch," poof, enter the picture.

"And I've been playing around
but I want this to be real.

Here's what I want to do.

I want to take my cubicle here and I've
got this little wall jack and I'm going

to unplug my computer that's plugged in.

I'm just going to-- I'm going
to plug it into my home switch."

And you click in there and you-- if it were made
for TV movie, you know, it would be slow motion.

There would be some guy jumping
over the cubicle going, "Nooo!"

You know, there'll be some drama here
but for now, you just click it in.

Light goes green and all of a sudden, poof!

First thing you notice you know-- first
thing anybody notices, you'll see a head poke

up in the cubicle farms and, you know, Bob
down the hall is like, "Hey, is your email up?"

You know, someone else is like, "No,
my Facebook access isn't up either."

You know, like people immediately
notice email and Facebook going down,

and you're kind of like, "Oh,
yeah," and you kind of unplugged it

and shoved the switch in the drawer.

What happened?

Well, what happened was you got this switch from
company X on eBay where they've been using it

for eight years and they've
probably made bajillion VLAN changes.

You know, deleting VLANs, adding VLANs
all that kind of stuff over the years.

Maybe they're up to VTP Rev 302, and
maybe that switch on there had VLAN 100.

That's was the only VLAN, you know, at this
point because you're playing with it in your lab

or whatever, that's the only VLAN that you had.

Well, as soon as you connected it to that
wall jack, it goes through the ceiling

and eventually connects back here.

This guy is like, "Hey buddy,
I've got VTP Rev 1302."

Your corporate switch is like, "Great, I'm at 2.

You know, it's like, you're way better."

So, the way VTP work is it's not like,
"Let's talk, let's kind of merge our VLANs

to get"-- no, that's not how it works.

He's like, "1302 says there is no VLAN 20.

1302 says, there is no VLAN 10, 1302 has told
me the only VLAN that there is, is VLAN 100."

And like I said, it's very fast, bam!

Bam! All your VLANs are gone in your entire
enterprise, all replaced by VLAN 100.

You know what that looks like?

You walked in to the IT room and you see
the switches and they've all turned amber.

Every light on them totally has gone from
green and flicking and happy to this amber

like death-like state and
usually, the IT person passes

out when they see it 'cause
the entire network is not.

What has happened is it eliminated VLANs 10 and
20, but all the ports are assigned to those.

So it's not like the ports are like,
"Oh, well, I guess our VLAN went away.

Let's all go over to VLAN 100 now."

They don't do that.

They're like, "No, I'm still in VLAN 20
and VLAN 20 doesn't exist so I'm going

to turn myself off, and I'm going
to put myself in a disabled state."

So essentially, your entire network goes down.

Now, I know what you might be thinking.

You're like, but wait a sec, didn't
you say I erased the switch, you know?

If you're speaking for my
life, didn't you tell me

that I erased the switch before I bring it in?

Yes, I did.

Because VTP revisions survive
configuration resets.

VLANs survive configuration resets.

So this little story could happen.

But now, let me add in a little reality to it.

Well, first of, it has happened a lot.

It completely takes on the network.

And the problem is, you know, people-- first
of, it takes somebody some time to figure

out what time-- I mean, you walk
in, the entire thing is down.

You're not thinking, "Oh,
my VLANs must be gone."

You're thinking virus, worm, outbreak, failure.

You know, you're on the phone
you're like, "What do I do?"

You're not even thinking straight when something
like this occurs, I mean, everybody is yelling.

You know, company is like,
"We're sending everybody home

for the day, losses," it's not good.

So, this is one of those not good days.

So by time you finally do figure out,
you're like, "Oh man, my VLANs are gone."

A common fix is you take a switch off,
you restore the configuration from backup,

you're like, "Okay, well let's put the
old VLANs back on," and you reconnect it.

What happen as soon as you reconnect?

Bam! Revision 1302 comes in and
destroys you and deletes your VLAN again.

The only way that you're going to get it
back is to manually add your VLANs back in.

So you go, "Okay, VLAN 10 exists."

Now, we're up to Rev 1303 and now
that replicates up, VLAN 20 exists,

1304 and we start getting our VTP Revs back up.

So, now let me add in now a little protection.

The way VTP works is through
a common domain name.

A lot of companies make it their company name
like Intel, they'll have the VTP domain Intel.

So, if this guy comes in and doesn't
have the same VTP domain name as the rest

of the switches, then his
revision will be ignored.

So, I know you're like kind of go,
"Okay, that's a little better."

Well, here's where it usually happens.

This-- By the way VTP outages
are-- they are common.

You know, if-- give me a group of, you know,
10 Cisco people that have worked for, you know,

10 to 15 years in the field and I
guarantee you, probably two or three

of them have seen a complete
network takedown from VTP.

So, where it usually happens
is in the lab environment.

You got the company lab, right, where the
company buys some stuff for people to play

with so that they can do testing.

They can do experiment without messing
with the production environment.

Well, what ends up happening is, you know,
there's a switch in the lab that seems

to be totally functional, totally fine that
we've just been playing with for a long time.

In a crisis, the company is like,
"Oh man, we're out of switches

and we just hired three more people.

Do we have any spares anywhere?"

You know, again, made for TV movie, slow
motion music comes as somebody walks in the lab

and brings out this lab switch which has a
higher VTP Rev than the corporate network

and happens to mirror the config in
many ways as the corporate network

but maybe doesn't have the
same VLAN numbers and click.

You know, that's where it
wipes out the entire network.

So, that's VTP.

It's kind of like, "Yeah, that was a cool
idea," but I will tell you Cisco now,

they have changed their recommendation.

Cisco will tell you in big bold
red letters, "Don't use it."

Despite Cisco's recommendations, many people
still do use VTP 'cause it is really handy.

And as long as you are very
careful, it works well.

Now, like I said, for every 10 Cisco
people, there'tr two or three of them

that have seen a complete network outage, but
that means there are seven or eight of them

that are like, "Yeah, it's totally fine."

So, when you're using VTP, there
are three modes that it can be in.

A Cisco switch can be a VTP
server which is the default.

When you pull it out of the box,
every Cisco switch has a VTP server.

And that means it has the power to create
VLANs, to delete VLANs, to rename VLANs,

it can do all that stuff and then send
the updates to all the other servers.

Now, you can have all your
switches, be servers if you want to.

And that just means you can change your
VLAN configuration from any switch.

Now, if you are going to use VTP, what Cisco
recommends is saying, you have one server,

meaning one place that you can
change VLANs from and all the rest

of them are configured as clients.

So the client switches you can't update VLANs.

They will only accept updates and send
updates, you know, if, you know, for instance,

there's a server down here or something
like that, he'll accept updates

and he'll send updates to the other switches.

But you can't go in there and
change VLANs, delete VLANs.

If you try to, if you log on to that switch
and you're like, "Okay, add VLAN 20."

It's going to be like, "Sorry,
you're a VTP client.

You can't do that."

Now there-- you might be
like, "Well, this seems safe.

How can I-- cause problem?"

Well, a lot of times, we are
our own worst enemies, right?

Because you log in to that client switch
and like, "Oh, man, I got to add VLAN 20,"

and you get the message, "I'm
sorry, this is a VTP client."

And you're like, "Well buddy, it's one command."

"No you're not.

You're a server."

You type in-- it's a literally command,
it's a VTP mode server and poof!

Now, I can add my VLAN without trying to figure
out where in the network my VTP server is.

So, good intention but a lot of times,
our own self-discipline gets away from us.

Transparent mode, now, the
Cisco recommended mode.

VTP transparent mode essentially
means I am not using VTP.

Truth be told, the way Cisco
switches work is there is no way to--

you know, I'll put in quotes, turn off VTP.

Like you can go in there and say,
"No VTP" and stop running it.

But you can go in and say, "I'm
running VTP Transparent mode."

And what that means is, now, every
single switch, if it's transparent,

every switch can change VLANs, it can
modify VLANs, it can delete VLANs,

it can do whatever we want, but I'm not
ever going to tell that VLAN information

to anybody else, meaning I'm
not really participating.

Now, if somebody sends me a VTP update, if maybe
somebody else is running VTP, I'll be like,

"Hey, thanks, I'll forward that on
to any other switches that need it.

But you know what, I'm not looking at it.

I'm a transparent switch."

You know, think of the words, "I'm transparent.

I don't exist to you," or we can add
some movie drama, "I'm dead to you."

You know, all the switches that are transparent
totally ignore it, but it is worthwhile knowing

like if I have a VTP server here and a VTP
server here and he's sending an update,

the transparent switch will ignore it
and yet still pass it over that server.

One more neat feature associated with VTP.

It's the concept of VLAN pruning.

What this allows you to do is stop VLANs
from crossing links where they don't belong.

So, let's say, you've got
this environment and setup

with three switches, you create three VLANs.

We'll just for now call them VLAN
green, VLAN blue, and VLAN red,

you know, which match up to some number.

So those are all created.

Those using VTP automatically replicate
and now appear on all the switches.

However, on this bottom switch, you only
assign computers to the red and blue VLAN.

You don't assign anything to the green VLAN.

Well, what VTP will do is have this
switch report back and say, "Hey,

green VLAN, we don't need it here."

There're no ports that belong here.

So, the switch-- this switch automatically
prunes green traffic from coming down here.

So if a green computer sends a broadcast
that will come down here but then stop.

It doesn't continue on and
like you see right here,

stops all the unnecessary broadcast
traffic from crossing the links.

Well, that's great, but here's the funny
thing, Cisco with their design and like, yeah,

you should have one server
and then multiple clients.

Well, VTP pruning only works
if you have all VTP servers.

Like if this guy is a VTP client,
you won't participate in VTP pruning.

So, a little ironic with the design there.

Now some of you might be thinking, "Well, if we
can't use VTP to do this, then how do we do it?"

Manually. You go back to
this-- the manual model.

That's how everybody else does it.

You go to every switch that needs
the VLAN, you manually create it,

you manually add it to the
trunk and that's okay.

I mean, if everything was auto, we
wouldn't really be paid for anything.

And I will tell you and this
is kind of a rule in general.

With anything auto in network
technology, mantra is you auto not use it

because it leaves too much to chance.

Anything that it's kind of like, "Oh, don't
worry, it just kind of figures it out for you."

I'm always like, "Really?

All the time, every time, 100 percent at time
it figures it out for me," I'd feel better.

I would just feel better if I could say, "Okay,
that trunk has this, this, and this VLAN."

That would just make me feel better to
manually type that in because again,

it's not that much work and it impacts so much.

So I would love for it to
come back and say, "Okay,

if it's working, I look at
them like that's good.

It's all me.

I know exactly"-- that sounded bad.

"It's all me, yeah."

But no, if it's working I'm like, you
know, "I know exactly what that configures.

I have backups that config,
I know what it looks like.

It's not just like, "Well,
it just kind of happened.

They just kind of figured it out."

And then if something goes wrong,
I'm like, "What's going wrong?

You know, what auto mechanism did this to me?"

So, that's the overview of
why we don't use VTP anymore.

So, to summarize, we saw in this Nugget
how the trunks really work and that's using

that 802.1Q protocol, industry standard
protocol that works VLANs across the board.

We saw the VLAN lingo of Native VLAN
so we know what that concept is.

It's essentially the untagged VLAN or the
untagged I should say number when we're working

on trunks-- my little [inaudible] connecting it.

When we're working on trunks, if I
send something without a tag it belongs

on that Native VLAN, and then of course
we discuss VTP and all its glory.

I hope this has been informative for you
and I'd like to thank you for viewing.