Blessay:VTP Version 3.0 — Is VTP Making a Comeback ?

VTP Version 3.0 — Is VTP mak­ing a comeback ?

I found this doc­u­ment at Cisco​.com today about VTPv3. What ? VTPv3 ? I had to dig into that.

Features

The doc­u­ment lists the fol­low­ing key features.

• Protection against data overwrites.
• Support for VLAN num­bers up to 4096
• Support for exchan­ging inform­a­tion regard­ing PVLANs
• Support for propaga­tion of other data­bases (not just VLAN data), spe­cific­ally MST data­bases but there are hooks for more in the future.

There is a bril­liant line here “VTP…is designed to sim­plify admin­is­tra­tion and to reduce unin­ten­ded con­fig­ur­a­tion errors.”. Without a doubt VTP is respons­ible for some of the biggest out­ages I have ever seen because of VTP revi­sion prob­lems when new switches are inser­ted into the net­work and not many net­works today run VTP for exactly that reason.

The paper notes that VTPv3 uses an entirely new code base. This is Cisco-​​speak for new soft­ware and you should look out for bugs for a while.

Where it would be useful ?

One of the most com­mon con­fig­ur­a­tion errors in  data centre occurs when someone fails to con­fig­ure the VLAN data­base on all switches. In this case, everything works until a fail­over occurs and, because the VLAN isn’t avail­able on the fail­over switch, a major prob­lem occurs. This situ­ation is dif­fi­cult to detect quickly since the fail­over event often obscures the actual cause.

On the other hand, I have seen an entire data centres taken off­line because a junior engin­eer plugged in a new switch at the top of a new rack and requir­ing phys­ical inter­ven­tion on every switch. For this reason, VTP is dis­abled in most places.

VTP — Let’s Recap, Its been a pain­ful journey

In large campus-​​style LAN (Universities /​ Large Enterprise) the auto­matic propaga­tion and con­sist­ency of VLAN alloc­a­tion means that VTP is a valu­able tool for redu­cing the cost of own­er­ship. In is typ­ical that hours we wasted main­tain­ing and resolv­ing VLAN num­ber­ing and alloc­a­tion issues, espe­cially in net­works where doc­u­ment­a­tion and records are not tightly main­tained. The his­tor­ical campus-​​wide out­age is the stuff of legend and VTP is not usu­ally enabled here either.

VTP was inten­ded to make admin­is­tra­tion of Layer 2 switch­ing domains easier by auto­mat­ic­ally propagat­ing VLAN details to all switches in a domain. It would be fair to say that in 1999 switch­ing domains were not that big, and admin­is­trat­ive con­trol was handled by very few people and often just one per­son. I think that VTP failed us when our net­works got very large and the short­com­ings of the pro­tocol were exposed in a large team that would have at least some poorly trained people.

Then we had the change from a sep­ar­ate data­base in the vlan.dat file to the main IOS con­fig­ur­a­tion which was handled badly. Because it seems to me that there was no con­sist­ent approach for the developers I con­clude VTP wasn’t going any­where. VTPv3 was intro­duced in CatOS 8.1, but only in Dec2008 was included in the C6500 IOS soft­ware. Therefore modi­fic­a­tions were being made on the fly, not in a con­sist­ent planned way.

These prob­lems, plus the huge out­ages I men­tioned earlier, mean that VTPv3 will need a really good story to get engin­eers and man­age­ment to agree on it’s implementation.

Good things in VTPv3

So what’s the good­ness in VTPv3 that might make you interested ?

No auto­matic setup of VTP domain

In VTPv2, a fact­ory default switch which receives a VTP mes­sage will auto­mat­ic­ally con­fig­ure to be in the VTP domain. It’s counter-​​intuitively a good idea, isn’t it ? But, in the real world, auto­matic con­fi­gru­ation makes you scared. VTPv3 forces manual configuration.

Support for all VLAN numbers

Well, except for 1000 – 1017 which are reserved, you can use VTP for propagat­ing all VLAN num­bers in accord­ance with the IEEE. This is the prob­ably the most import­ant feature.

Security

The VTP domain pass­word is secured in the data­base and in transmission.

Database Propagation Fixed

The other vital ingredi­ent. “With VTP ver­sion 3, only a spe­cific device in a domain, a primary server, is allowed to update other devices.” Logically, only one server per domain can be a primary server. Secondary serv­ers can be defined, but they can never be con­figured and the sec­ond­ary server will update its data­base from the Primary exclusively.

When you con­fig­ure the Primary VTPv3 server, its checks the VTP mes­sages to determ­ine if any other serv­ers are Primary before ask­ing for con­firm­a­tion. See below (taken from the Cisco Web Site)

Catalyst6500-1#vtp primary vlan

This system is becoming primary server for feature vlan

No conflicting VTP3 devices found.

Do you want to continue? [confirm]

*Jul 8 12:34:20.047: %SW_VLAN-SP-4-VTP_PRIMARY_SERVER_CHG: 00d0.bcd2.0c00 has become the primary server for the VLAN VTP feature.

What’s the bad news ?

Limited Device/​Software Support

At time of writ­ing, VTPv3 is only avail­able for 12.2.33SXI releases on the C6500 for late mod­els of Supervisor, 12.2.50SG2 on the C4500 with late model of Supervisor (Sup2+/4/5/6). This means that you need to care­fully check all the mod­ules in your chassis to make sure they are com­pat­ible with this code train.

Interoperability

“VTP3 inter­op­er­ates with VTP ver­sion 2 but not VTP ver­sion 1. For devices that are cap­able of run­ning VTP ver­sion 2 but are run­ning in VTP ver­sion 1 mode, a change to VTP ver­sion 2 is triggered by the VTP ver­sion 3 device. Before con­sid­er­ing VTP ver­sion 3 for your net­work it is recom­men­ded that you verify if all switches in the exist­ing or pro­spect­ive VTP domain are cap­able of run­ning in VTP ver­sion 2 mode.” — got that ? For a big net­work with old bits in it, it gonna be pain­ful.

Am I going to use it ?

Yes, in DMZ’s that use PVLANs this is going to be a fant­astic way to

• solve my prob­lems with firewall/​security people who don’t under­stand VLANs and espe­cially PVLANs.
• more con­sist­ent oper­a­tion for VLANs lead­ing to less out­ages when people don’t con­fig­ure the VLANs correctly.

And because DMZ’s are reas­on­ably small net­works (you DMZ’s are on phys­ic­ally sep­ar­ate switches aren’t they ? ), it will be easy to imple­ment on just a few pieces of kit that are tightly controlled.

Anything Else ?

I would be just about guess­ing here. But I think that VTPv3 will be a vital part of the Data Center Ethernet and the Shortest Path Bridging stand­ards from the IEEE. There needs ot be a lot of syn­chrony between switches that are going to exchange QoS, SPBB and all the other inform­a­tion that Data Center Ethernet (or Converged Enhanced Ethernet, or Data Center Bridging — whatever you want to call it) will need to func­tion. I sus­pect that we will all see a lot more of VTPv3 in the next couple of years.

Please rate this post:

(4 votes, average: 7.00 out of 10)

 Loading ...