Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
Training Camp • Cybersecurity Glossary
Server, client, and transparent, the three Cisco VTP roles that control whether a switch creates, learns, or ignores VLAN propagation.
VTP Modes Definition: Server, client, and transparent, the three Cisco VTP roles that control whether a switch creates, learns, or ignores VLAN propagation.
VTP modes are the operational roles a switch running Cisco's VLAN Trunking Protocol (VTP) can take: server, client, and transparent. The mode determines whether a switch can create and change VLANs, whether it accepts VLAN updates from other switches, and whether it propagates those updates across trunk links, controlling how VLAN configuration is synchronized across a switched domain.
In server mode (the default), a switch can create, modify, and delete VLANs and advertises these changes to the rest of the VTP domain. Client mode switches cannot make VLAN changes locally; they receive and apply VTP advertisements and forward them onward, keeping a copy synchronized to the servers. Transparent mode switches do not participate in VTP synchronization, they keep their own local VLAN database, but they still forward VTP advertisements through to other switches on trunks. A later addition, VTP version 3 also introduced an off mode that stops forwarding advertisements entirely. Switches accept an update only if the advertisement's configuration revision number is higher than their own.
VTP modes matter for security and availability because that revision-number behavior creates a real risk. A switch, even a client, with a higher revision number than the production servers will overwrite the entire domain's VLAN database when connected to a trunk. An attacker or careless technician can plug in a previously used switch and wipe VLANs network-wide, a denial-of-service and segmentation failure. Choosing transparent mode (or VTP off, or static VLANs) and setting strong VTP domain passwords mitigates this.
For example, an engineer reuses an old lab switch with revision 50 and trunks it into a network whose servers sit at revision 30. Because 50 is higher, the lab switch's sparse VLAN database propagates and the production VLANs vanish, dropping connectivity for entire segments. Running access switches in transparent mode, or resetting the revision before connecting, prevents this outage.
Turn knowledge into credentials with our instructor-led cybersecurity boot camps.
View All Courses →