switchport nonegotiate
Harden switch ports against VLAN hopping attacks by disabling DTP on both access and trunk ports.
Definition: switchport nonegotiate is a Cisco IOS interface config command. Disables DTP (Dynamic Trunking Protocol) frame generation on a switch port, preventing the port from actively negotiating trunk mode with the connected device.
Overview
The `switchport nonegotiate` command is a critical tool for controlling Dynamic Trunking Protocol (DTP) behavior on Cisco switch ports. DTP is a Cisco proprietary protocol that automatically negotiates trunking between two switches. While convenient, DTP can introduce security risks and configuration inconsistencies, especially in production networks where trunking should be explicitly configured.
This command disables DTP on a specific switch port, preventing the port from sending or receiving DTP frames. As a result, the port will not attempt to negotiate a trunk; it will remain in the configured mode (access or trunk) without any negotiation. This is particularly important in secure environments where you want to prevent unauthorized trunk links or avoid accidental trunk formation that could cause VLAN hopping attacks.
The command is used in interface configuration mode and requires privilege level 15 (enable mode). It immediately affects the running configuration, and the change is written to the startup configuration when saved. The command is available on most Cisco switches running IOS, including Catalyst 2960, 3560, 3750, and 4500 series.
It is not available on routers or devices that do not support switching. The concept behind DTP is that it uses frames to negotiate trunking; by disabling it, you eliminate that negotiation, forcing the port to operate strictly as configured. This is often used in conjunction with `switchport mode trunk` or `switchport mode access` to lock down the port's behavior.
In a broader workflow, you would typically configure the port mode first, then apply `switchport nonegotiate` to ensure no negotiation occurs. This command is part of a security best practice known as "hardening" switch ports. It is also useful when connecting to non-Cisco devices that may misinterpret DTP frames.
Alternatives include using `switchport mode dynamic desirable` or `dynamic auto` with DTP enabled, but those rely on negotiation. The `nonegotiate` command is the only way to completely disable DTP on a port. Important IOS behavior: once applied, the port will not generate DTP frames, but it will still respond to DTP frames if the remote device sends them?
Actually, no—it will ignore incoming DTP frames. Also, the command is not supported on all platforms; for example, on some older switches, it may be hidden or not available. Always verify with `show interfaces trunk` to confirm trunking status after configuration.
switchport nonegotiateWhen to Use This Command
- Security hardening on access ports to prevent VLAN hopping via DTP manipulation
- Required on trunk ports connecting to non-Cisco devices that don't understand DTP
- Prevent DTP frames from being seen by packet capture tools on the segment
- Used with switchport mode trunk on uplinks to non-Cisco switches or routers
Command Examples
Disable DTP on an access port
Switch(config)# interface GigabitEthernet1/0/1 Switch(config-if)# switchport mode access Switch(config-if)# switchport nonegotiate Switch(config-if)# end Switch# show interfaces GigabitEthernet1/0/1 switchport | include Negotiation Negotiation of Trunking: Off
Understanding the Output
Negotiation of Trunking: Off confirms DTP is disabled. DTP disabled means the port does not send DTP frames and ignores received DTP frames — it stays in whatever mode was administratively configured (access or trunk).
Configuration Scenarios
Disable DTP on a Trunk Port to Prevent Negotiation
In a secure data center, you want to ensure that trunk links between switches are explicitly configured and not negotiated dynamically. This prevents accidental trunk formation or VLAN hopping attacks.
Topology
SW1(Gi0/1)---trunk---(Gi0/1)SW2Steps
- 1.Step 1: Enter global configuration mode: SW1> enable
- 2.Step 2: Enter interface configuration mode: SW1# configure terminal
- 3.Step 3: Select the interface: SW1(config)# interface GigabitEthernet0/1
- 4.Step 4: Set the port to trunk mode: SW1(config-if)# switchport mode trunk
- 5.Step 5: Disable DTP: SW1(config-if)# switchport nonegotiate
- 6.Step 6: Exit and save: SW1(config-if)# end; SW1# copy running-config startup-config
! interface GigabitEthernet0/1 switchport mode trunk switchport nonegotiate !
Verify: Use `show interfaces trunk` to verify the port is trunking and DTP is disabled. Expected output: Port Mode: Trunk; Encapsulation: 802.1q; Status: trunking; Native VLAN: 1; DTP: Off.
Watch out: If you forget to set the port to trunk mode first, the port will remain in access mode and will not form a trunk. The `switchport nonegotiate` command only disables DTP; it does not change the port mode.
Secure an Access Port by Disabling DTP
To prevent a user from accidentally or maliciously forming a trunk by connecting a switch to an access port, you disable DTP on all access ports. This is part of a port security best practice.
Topology
SW1(Gi0/2)---access---(Gi0/2)PCSteps
- 1.Step 1: Enter global configuration mode: SW1> enable
- 2.Step 2: Enter interface configuration mode: SW1# configure terminal
- 3.Step 3: Select the interface: SW1(config)# interface GigabitEthernet0/2
- 4.Step 4: Set the port to access mode: SW1(config-if)# switchport mode access
- 5.Step 5: Disable DTP: SW1(config-if)# switchport nonegotiate
- 6.Step 6: Exit and save: SW1(config-if)# end; SW1# copy running-config startup-config
! interface GigabitEthernet0/2 switchport mode access switchport nonegotiate !
Verify: Use `show interfaces GigabitEthernet0/2 switchport` to verify. Look for "Negotiation of Trunking: Off" in the output.
Watch out: On some switch models, `switchport nonegotiate` is only supported on trunk ports. If applied to an access port, the command may be accepted but have no effect. Always verify with `show interfaces switchport`.
Troubleshooting with This Command
When troubleshooting DTP-related issues, the `switchport nonegotiate` command is often used to resolve trunking problems. A healthy scenario is when a trunk link is up and stable, with DTP disabled on both ends. You can verify this with `show interfaces trunk`.
Look for the port in the trunking mode list and check the "DTP" column; it should show "Off" for ports with nonegotiate configured. If DTP is still enabled, you may see "On" or "Desirable". Common symptoms that indicate DTP issues include: a trunk link not forming, a port unexpectedly becoming a trunk, or VLAN hopping vulnerabilities.
If a trunk is not forming, first check if both ends are configured with the same trunking mode (e.g., both trunk). If one end is set to dynamic desirable and the other to dynamic auto, DTP may fail if the cable is faulty or if one side does not support DTP. In such cases, using `switchport nonegotiate` on both ends forces the port to stay in the configured mode, eliminating negotiation.
Another common symptom is a port flapping between access and trunk modes, which can be caused by DTP misconfiguration. To diagnose, use `debug dtp packets` (with caution) to see DTP frames being sent and received. However, in production, it's safer to use `show interfaces switchport` to see the current mode and negotiation status.
A step-by-step diagnostic flow: 1) Identify the problematic port with `show interfaces status`. 2) Check the current trunking status with `show interfaces trunk`. 3) Verify the port's switchport configuration with `show interfaces switchport`. 4) If DTP is enabled and causing issues, configure `switchport nonegotiate` on the interface. 5) Re-verify with `show interfaces trunk` to confirm the port is in the desired mode. Correlate with `show running-config interface` to ensure the configuration is applied. If the problem persists, check for hardware issues or mismatched VLANs.
Remember that `switchport nonegotiate` does not affect the port's ability to trunk; it only disables DTP. If the port is in access mode, it will not trunk regardless of DTP. So if you need a trunk, ensure the mode is set to trunk.
CCNA Exam Tips
CCNA security exam: VLAN hopping attack via DTP requires the attacker's NIC to send DTP frames to negotiate a trunk. switchport nonegotiate defeats this by stopping DTP negotiation
Best practice: switchport mode access + switchport nonegotiate on ALL host-facing ports. switchport nonegotiate alone without switchport mode access is insufficient
Common Mistakes
Using switchport nonegotiate without switchport mode access — if the port is still dynamic auto, it can still become a trunk if DTP is somehow negotiated
Not applying on trunk uplinks to non-Cisco devices — DTP frames may confuse or be misinterpreted by third-party switches
switchport nonegotiate vs switchport mode access
Both switchport nonegotiate and switchport mode access prevent a switch port from forming a trunk via DTP, but they operate at different layers. switchport nonegotiate only stops generating DTP frames without changing the port's administrative mode, whereas switchport mode access forces the port into access mode and inherently disables DTP. They are commonly confused because both achieve a similar external result but have distinct internal behaviors and implications.
| Aspect | switchport nonegotiate | switchport mode access |
|---|---|---|
| Scope | Disables DTP frame generation only; port mode unchanged. | Sets port to access mode and disables all DTP negotiation. |
| Configuration mode | Interface configuration mode; applies to any switch port. | Interface configuration mode; typically used after mode access. |
| Persistence | Port remains in current operational mode (access or trunk) depending on previous configuration. | Port is forced to access mode permanently; trunking cannot be negotiated. |
| Precedence | Does not override switchport mode; can be combined with mode dynamic desirable/auto. | Overrides any dynamic mode; port becomes static access. |
| Typical use | Security hardening: stop DTP while retaining dynamic mode if desired. | Standard access port for end devices; prevents accidental trunking. |
Use switchport nonegotiate when you need the port to keep its current mode (e.g., dynamic auto/desirable) but want to suppress DTP frames for security or compatibility reasons.
Use switchport mode access when you want to statically define the port as an access port and ensure it never attempts to trunk, suitable for connecting end hosts.
Platform Notes
In IOS-XE (e.g., Catalyst 3650, 3850, 9300), the `switchport nonegotiate` command is supported and behaves identically to classic IOS. However, in IOS-XE, the output of `show interfaces trunk` may include additional fields like "Mode" and "Encapsulation" in a slightly different format. For NX-OS (e.g., Nexus 3000, 9000), the equivalent command is `switchport mode trunk` and `no switchport negotiate`?
Actually, NX-OS does not use DTP; it uses a different mechanism. On Nexus switches, trunking is configured with `switchport mode trunk` and there is no DTP negotiation. To disable negotiation, you can use `switchport trunk native vlan` and `switchport trunk allowed vlan`, but there is no direct `nonegotiate` command.
For ASA firewalls, the concept does not apply as they do not have switch ports. In IOS versions prior to 12.2(25)SEC, the command may not be available on all platforms. In IOS 15.x and 16.x, the command is fully supported.
On IOS-XR (e.g., ASR 9000), the command does not exist because IOS-XR uses a different interface configuration model. Always check the specific platform documentation. On some older Catalyst switches (e.g., 2950), the command is available but may be hidden; use `switchport nonegotiate` in interface config mode.
The command is not supported on routed ports (no switchport). If you attempt to apply it to a routed port, the switch will reject it with an error message.
Related Commands
show interfaces trunk
Displays all trunk ports including the trunking encapsulation (802.1Q or ISL), the native VLAN, VLANs allowed on the trunk, VLANs in the spanning tree forwarding state, and VLANs active in the management domain.
switchport mode access
Statically configures a switch port as an access port, disabling all DTP negotiation so the port permanently carries traffic for a single VLAN and can never negotiate to trunk mode.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions