What does VTP version 3 change, and would you run it?
Show the answer
Say this first
VTPv3 adds a primary server. Only the switch promoted with vtp primary can change the database; other
servers just store and relay it. A switch with a higher revision but a different primary server ID
cannot take over the domain, which removes the classic disaster. It also carries extended VLANs
(1006 to 4094), private VLANs and MST region config, supports a hidden password and off mode, and can
be disabled per trunk. A mistake on the primary still spreads everywhere in seconds.
Go deeper
Setup
SW1(config)# vtp domain CORP
SW1(config)# vtp version 3
SW1(config)# vtp mode server
SW1(config)# vtp password Str0ngSecret hidden
SW1(config)# end
SW1# vtp primary vlanvtp primary is an EXEC command, not a config line. It asks for confirmation and for the password.
Other switches run vtp mode server (secondary servers) or client.
Separate features
The VLAN database and the MST region config are separate VTPv3 features, each with its own primary
(vtp primary mst). That lets you keep the MST name, revision and VLAN-to-instance mapping identical
on every switch, which is the hardest part of running MST.
Per-port control
no vtp on an interface stops VTP on that trunk, useful at the edge of the domain.
Would I run it
It is safe from the stray-switch problem, and MST sync is a real benefit. The remaining risk is human: a VLAN deleted on the primary disappears from every switch. Shops with good automation often prefer transparent or off mode plus a source of truth that pushes VLANs.
They will ask next
How do you move the primary role to another switch?
Run
vtp primaryon the new switch. It announces itself and the domain follows it; the old primary becomes a secondary server.
Traps
- Assuming VTPv3 protects you from a mistake made on the primary. It protects you from the wrong switch, not the wrong command.