VLAN Trunking 6: DTP and Trunk Hardening

Bundle lab

Hands-on DTP negotiation and trunk hardening across a 3-switch path. You will observe dynamic trunking behavior (auto vs desirable), fix an allow-list drift that blocks user VLAN transport, and then harden the trunks to static with nonegotiate and a non-default native VLAN. End-to-end host reachability in the same VLAN proves success.

Learning objectives

• Differentiate DTP dynamic auto vs dynamic desirable and predict whether a trunk will form.
• Use show interfaces switchport and show interfaces trunk to verify negotiation and trunk state.
• Detect and remediate a trunk allowed-VLAN drift that breaks end-to-end VLAN transport.
• Standardize the native VLAN and verify mismatch detection and resolution.
• Harden trunks to a permanent static 802.1Q configuration so DTP no longer negotiates the trunk, using a non-default native VLAN.
• Harden access ports with portfast, bpduguard, and sticky port-security.

Troubleshooting focus

• The ACC1–DIST1 uplink never trunks during the DTP exploration: show interfaces switchport reports dynamic auto on both ends. Auto+auto will not trunk — set one side to dynamic desirable.
• ping -c 3 10.10.10.20 from CLIENT-A still fails after both links appear in show interfaces trunk: confirm both trunks allow VLAN 10 on both ends. A one-sided allow-list is enough to block it.
• Native VLAN mismatch messages appear: make both sides of that trunk use the same native VLAN, 999. Avoid native VLAN 1.
• One host is still down while the other works: confirm the correct access VLAN on its port, and that sticky port-security has learned only one MAC with no violations.
• The symptom does not match what you configured: re-check with show interfaces trunk, show interfaces switchport and show vlan brief on each switch.