2

Is DTP (Dynamic Trunking Protocol) enabled by default on the newest Cisco devices?

I have been using Cisco 2960 switches and DTP is enabled by default. I was wondering if this was the same for the latest and greatest switches? I am assuming it depends on the IOS version and I couldn't find anything specific for the newest versions.

The reason I ask is because I was doing a demonstration of a VLAN hopping attack in which you first initiate trunking from your attacking device. Then once you get the trunk (assuming DTP is enabled) you can use 802.1Q double-tagging to reach a device outside of the native vlan. At the end of demonstration, I was asked if the newest Cisco devices still enabled DTP by default and told the person I would get back to them.

Thanks!

6
  • 1
    Latest and greatest is very vague wording. Cisco Nexus is probably the most advanced Cisco's switches family at the time. Those devices don't run IOS. Cisco created NX-OS instead. And DTP is simply not supported at all. – ar_ May 3 '17 at 18:38
  • @artem_d93 okay that is actually the answer I was looking for. Thank you. Is anything used in place of DTP for NX-OS? Do you they just have configure the trunks manually or is there new protocol – nd510 May 3 '17 at 18:40
  • 2
    They do configure trukns manually. This is actually a good idea to configure such things manually. – ar_ May 3 '17 at 18:42
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Feb 19 '18 at 3:50
  • @RonMaupin ar_ comments were the most helpful, so if it was an answer I would accept that – nd510 Feb 20 '18 at 17:08
3

The newest small campus access switches are 2960X switches, and they still have DTP enabled by default.

Nexus switches are designed for datacenter use, not for user-facing ports.

DTP is also enabled by default on 3850s, 3650s, and every other switch I get my hands on.

I'm still waiting on a global disable command for it - a 'no dtp run' or similar. For the time being, it's still strongly recommended to hardcode your port as an access or trunk port, configure "switchport nonegotiate" on the port, and for trunk ports, configure a dead VLAN as the native (I like to use 999 and make sure it doesn't exist in my VLAN database).

1
  • Just never allow the native VLAN on a trunk. Cisco devices do not require a native VLAN. You could leave VLAN 1 as the native VLAN (it is the default VLAN, and it should never be used, anyway), then simply exclude VLAN 1 from the trunk. You solve both the native and default VLAN security problems that way. – Ron Maupin Jul 21 '18 at 20:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.