I am trying to make a C2811 (yes, with switching ports, thank you very much) join a VTP domain. This fails with the syslog message

VTP LOG RUNTIME: DRAM failed for domain

This is rare, but google does turn up nothing for that. Checked the VTP version (2), password and domain name (yes did make a mistake with that, at first) but the C2811 downgrades from client to transparent the moment I set the domain name. The previous mentioned message is preceded by:

VTP LOG RUNTIME: Subset packet received, domain = [DELETED], rev = 43, seq = 1, length = 612
%SW_VLAN-6-VTP_MODE_CHANGE: VLAN manager changing device mode from CLIENT to TRANSPARENT.
VTP LOG RUNTIME: VTP mode changed to Transparent.

The C2811 does have a limit of max 36 vlans, but the number to be passed through VTP is 25. Another switch joined the domain nicely.

The DRAM message let me to check memory, but that didn't reveal anything either:

sh mem sum
                Head    Total(b)     Used(b)     Free(b)   Lowest(b)  Largest(b)
Processor   4813DE60   118235552    44749540    73486012    69242144    68504536
      I/O   3F200000    14680064     7002632     7677432     7262336     7610556

I am at a loss, anybody know something how to solve this?

Added for @hertitu :

Cisco IOS Software, 2800 Software (C2800NM-ADVIPSERVICESK9-M), Version 12.4(24)T, RELEASE SOFTWARE (fc1)    

c2811# sh vtp stat  
VTP Version : 2  
Configuration Revision : 0  
Maximum VLANs supported locally : 36  
Number of existing VLANs : 5  
VTP Operating Mode : Transparent  
VTP Domain Name : MYCOMPANY  
VTP Pruning Mode : Disabled  
VTP V2 Mode : Enabled  
VTP Traps Generation : Disabled 
MD5 digest : 0xC3 0x66 0xAA 0x9A 0x4C 0x6C 0x22 0x97
Configuration last modified by at 10-14-16 07:03:14 

c3750# sh vtp stat  
VTP Version : 2  
Configuration Revision : 43  
Maximum VLANs supported locally : 1005  
Number of existing VLANs : 25  
VTP Operating Mode : Server  
VTP Domain Name : MYCOMPANY  
VTP Pruning Mode : Disabled  
VTP V2 Mode : Enabled  
VTP Traps Generation : Disabled  
MD5 digest : 0xC2 0x15 0x21 0xDF 0x96 0xA9 0xD9 0xAC  
Configuration last modified by at 10-14-16 12:03:57 –  
Local updater ID is on interface Vl1 (lowest numbered     VLAN interface found)  

Another clue: router that I claimed joined the domain nicely (a WS-C3650-24TS/(CAT3K_CAA-UNIVERSALK9-M), Version 03.03.05SE) did indeed join -same revision number and sh vl brief matches-, but gives a MD5 mismatch:

`c3650#sh vtp status  
VTP Version capable             : 1 to 3
VTP version running             : 2
VTP Domain Name                 : MYCOMPANY
VTP Pruning Mode                : Disabled
VTP Traps Generation            : Disabled
Device ID                       : 0035.1aa8.cb80
Configuration last modified by at 10-14-16 12:03:57

Feature VLAN:
VTP Operating Mode                : Client
Maximum VLANs supported locally   : 1005
Number of existing VLANs          : 25
Configuration Revision            : 43
MD5 digest                        : 0xA2 0x76 0x9C 0xF7 0x0A 0x1A 0x0D 0xBF 
                                    0x13 0xEE 0x4A 0x25 0x59 0x9F 0xF0 0xA7 
*** MD5 digest checksum mismatch on trunk: Gi1/0/24 ***
  • What is the IOS version? – hertitu Oct 16 '16 at 9:38
  • Can you also edit your post to include sh vtp stat from both the 2811 and the VTP server please? – hertitu Oct 16 '16 at 10:09
  • Can you try debug sw-vlan vtp events and debug sw-vlan vtp packets and see if that gives any clue? And BTW when you say "Another switch joined the domain nicely." do you mean a 'real' switch or also a 2811 with switch ports? – hertitu Oct 18 '16 at 13:01

Ok, got the cause cornered, I think. It looks like an IOS version problem: making the 2811 vtp server and any switch vtp client works as expected. The other way round never works. Conclusion: vtp versions are not upwards compatible. Since the goal was primarily to move all local routing decisions to the switches to relieve the router load, making the router server will not solve the problem. So I made the router "stupid" (not vlan aware) by removing all vtp settings and the vlan.dat and got an actual performance increase. This gives me another problem of setting the local acls on the switches and the remote (vpn/internet) on the router, but that is something for another question. All people who helped: thanks.


While you claim to have checked the VTP passwords, the 2811 and the 3750 have the same VTP domain name, but they are clearly configured with different VTP passwords.

  • 2811: MD5 digest : 0xC3 0x66 0xAA 0x9A 0x4C 0x6C 0x22 0x97
  • 3750: MD5 digest : 0xC2 0x15 0x21 0xDF 0x96 0xA9 0xD9 0xAC

The passwords must match for VTP to work correctly. You can verify this by the show vtp password command. It could be as simple as having a space at the end of the password entered on one device.

The current Cisco best practices are to only have a VLAN on a single access switch. You can have as many VLANs as you like on an access switch, just don't trunk those VLANs to other access switches. Don't connect access switches to each other, only to a distribution switch. Disable VTP by setting all the switches to vtp mode transparent, and limit the VLANs allowed across the trunks to the VLANs which are actually used on each switch with the switchport trunk allowed vlan command, along with the switchport trunk and switchport nonegotiate commands to unconditionally trunk. Also use the global spanning-tree portfast default and spanning-tree portfast bpduguard default commands so that any switch connections to an access port will err-disable the access port.

Doing this will eliminate almost all STP problems, and it will limit any that do happen to a single access switch.

  • c2811#sh vtp password The VTP password is not configured. c2811#q c3750>ena Password: c3750#sh vtp password The VTP password is not configured. – JdeHaan Oct 18 '16 at 6:57
  • There is a problem with your passwords. You need to set the passwords the same so that the MD5 digests match, otherwise you will never get it to work. – Ron Maupin Oct 18 '16 at 13:48
  • @ Ron Maupin ♦: I think you are not right on the thought that MD5 digests are equal when the passwords are the same. Here is my session to equalize them with the syslog : link – JdeHaan Oct 18 '16 at 17:38
  • The MD5 Digests must match. See Understanding VLAN Trunk Protocol (VTP): "If you configure a password for VTP, you must configure the password on all switches in the VTP domain. The password must be the same password on all those switches. The VTP password that you configure is translated by algorithm into a 16-byte word (MD5 value) that is carried in all summary-advertisement VTP packets." If you search the Internet for cisco vtp md5 digest, you will find that what I wrote is true. – Ron Maupin Oct 18 '16 at 18:00
  • @ Ron Maupin♦ : But if you look at my session you see me equalize the passwords and that the MD5 sums not match. "¿Qué pasa?" ;-) – JdeHaan Oct 18 '16 at 18:12

As Ron mentioned, the MD5 hash must match in order for a VTP domain to synchronise.

Apart from the Domain name and the password, you will also need to ensure that the VLAN names match.


Switch#sh vtp status
MD5 digest                        : 0x3B 0xF7 0xB3 0x53 0xC6 0x77 0x21 0x42
                                 0xC2 0x47 0x29 0x56 0x52 0xEE 0xEF 0xC9

Switch#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#vlan 100
Switch(config-vlan)#name NetworkEngineering
*Mar  1 00:06:19.970: %SYS-5-CONFIG_I: Configured from console by console
Switch#sh vtp status
MD5 digest                        : 0x0E 0xAC 0xC2 0x81 0xF0 0xFB 0xB9 0xC4
                                0xC7 0xFC 0x76 0x9A 0x93 0xE8 0xD3 0x11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.