2

Is DTP (Dynamic Trunking Protocol) enabled by default on the newest Cisco devices?

I have been using Cisco 2960 switches and DTP is enabled by default. I was wondering if this was the same for the latest and greatest switches? I am assuming it depends on the IOS version and I couldn't find anything specific for the newest versions.

The reason I ask is because I was doing a demonstration of a VLAN hopping attack in which you first initiate trunking from your attacking device. Then once you get the trunk (assuming DTP is enabled) you can use 802.1Q double-tagging to reach a device outside of the native vlan. At the end of demonstration, I was asked if the newest Cisco devices still enabled DTP by default and told the person I would get back to them.

Thanks!

Improve this question
6
  • 1
    Latest and greatest is very vague wording. Cisco Nexus is probably the most advanced Cisco's switches family at the time. Those devices don't run IOS. Cisco created NX-OS instead. And DTP is simply not supported at all.
    – ar_
    Commented May 3, 2017 at 18:38
  • @artem_d93 okay that is actually the answer I was looking for. Thank you. Is anything used in place of DTP for NX-OS? Do you they just have configure the trunks manually or is there new protocol
    – nd510
    Commented May 3, 2017 at 18:40
  • 2
    They do configure trukns manually. This is actually a good idea to configure such things manually.
    – ar_
    Commented May 3, 2017 at 18:42
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Commented Feb 19, 2018 at 3:50
  • @RonMaupin ar_ comments were the most helpful, so if it was an answer I would accept that
    – nd510
    Commented Feb 20, 2018 at 17:08

1 Answer 1

Reset to default
3

The newest small campus access switches are 2960X switches, and they still have DTP enabled by default.

Nexus switches are designed for datacenter use, not for user-facing ports.

DTP is also enabled by default on 3850s, 3650s, and every other switch I get my hands on.

I'm still waiting on a global disable command for it - a 'no dtp run' or similar. For the time being, it's still strongly recommended to hardcode your port as an access or trunk port, configure "switchport nonegotiate" on the port, and for trunk ports, configure a dead VLAN as the native (I like to use 999 and make sure it doesn't exist in my VLAN database).

Improve this answer
1
  • Just never allow the native VLAN on a trunk. Cisco devices do not require a native VLAN. You could leave VLAN 1 as the native VLAN (it is the default VLAN, and it should never be used, anyway), then simply exclude VLAN 1 from the trunk. You solve both the native and default VLAN security problems that way.
    – Ron Maupin ♦
    Commented Jul 21, 2018 at 20:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.