# Dynamic desirable

> Source: Courseiva IT Certification Glossary — https://courseiva.com/glossary/dynamic-desirable

## Quick definition

Dynamic desirable is a setting on a Cisco switch port that tells the port to try to become a trunk link. If the port on the other end is also set to trunk, desirable, or auto, the two ports will form a trunk. If the other end is set to access mode only, the link stays as an access link. It is a way to automatically decide if a link should carry multiple VLANs.

## Simple meaning

Imagine you have two buildings that need to share mail between departments. In one building, you have a special mail chute that can either send only one type of mail or many types. Dynamic desirable is like telling your mail chute to first ask the other building if it wants to exchange many types of mail. If the other building says yes, they set up a system to swap all department mail. If the other building says it only handles one type, your chute just sends that one type. This way, you do not have to manually decide which setup to use each time a new connection is made. In networking, a trunk is a link that carries traffic for many VLANs, while an access link carries traffic for just one VLAN. Dynamic desirable makes the port actively offer to become a trunk. It is like being the person who always says, hey, want to trade all kinds of mail? If the other side agrees, the trunk forms automatically. If not, the port stays as a simple access port. This saves network engineers from having to configure every link by hand, especially in larger networks where many switches are connected together. The key point is that dynamic desirable is the most talkative setting it will always start the conversation about trunking. This is different from dynamic auto, which just listens and waits for the other side to offer trunking first. So dynamic desirable is like a friendly neighbor who always says hello first, while dynamic auto is the shy neighbor who only responds if someone else says hello first.

In a real Cisco switch, this setting uses a protocol called Dynamic Trunking Protocol (DTP) to send messages back and forth. When you set a port to dynamic desirable, it sends DTP frames to the other switch port, asking if it wants to form a trunk. The other port replies based on its own setting. If the other port is set to trunk, dynamic desirable, or dynamic auto, it will agree and the trunk forms. If the port is set to access, it refuses and the link stays as an access link. This automation is very useful but also carries some security risks, which is why many network engineers disable DTP on ports that should never trunk.

## Technical definition

Dynamic desirable is a Cisco proprietary switch port mode configuration used on interfaces to automatically negotiate trunking using the Dynamic Trunking Protocol (DTP). This mode is part of a set of IEEE 802.1Q trunking negotiation options available on Cisco switches. When a switch port is configured with the switchport mode dynamic desirable command, it actively sends DTP frames to the connected device, indicating a willingness to form a trunk. The remote port can respond in several ways depending on its own configuration. If the remote port is set to trunk mode, dynamic desirable, or dynamic auto, the two ports will successfully negotiate an 802.1Q trunk. If the remote port is set to access mode, the link remains an access link, and DTP frames are still exchanged but do not result in trunk formation. DTP operates at Layer 2 of the OSI model and uses multicast frames with a destination MAC address of 01-00-0C-CC-CC-CC. The protocol runs only on Ethernet interfaces and is primarily used on Cisco catalysts switches. The negotiation process involves sending DTP packets every 30 seconds by default, though this interval can be modified in some switch firmware. When a port is in dynamic desirable mode, it will also accept trunking requests from the other side, meaning it is both proactive and responsive. This makes dynamic desirable the most aggressive of the non-trunk mode for creating trunk links automatically. In contrast, dynamic auto will only form a trunk if the remote port actively requests it by being in trunk or dynamic desirable mode. Access mode and trunk mode are static configurations that disable DTP negotiation entirely (trunk mode still sends DTP but does not allow negotiation to an access link). The switchport nonegotiate command can be used to disable DTP on a port, which overrides any dynamic mode setting. When DTP is disabled, no trunk negotiation occurs, and the operator must manually configure parameters for the trunk or access link. In real implementations, dynamic desirable is commonly used on links between two Cisco switches where trunking is expected but not certain, such as when connecting to a switch that may be replaced or reconfigured. However, security best practices often advise against using dynamic modes, especially on access ports connected to end devices like workstations or servers, because DTP frames can be spoofed by an attacker to create a trunk and gain access to multiple VLANs. This is known as a VLAN hopping attack. For this reason, many network administrators set all end-user ports to access mode and disable DTP with the switchport nonegotiate command. On trunk links between trusted switches, dynamic desirable can be convenient but is generally replaced by statically setting trunk mode to ensure stability and prevent accidental misconfigurations. In the context of the CCNA exam, understanding dynamic desirable means understanding DTP negotiation states, the outcomes of combinations with other modes, and the security implications. Candidates must know that a port in dynamic desirable will form a trunk with another port in trunk, dynamic desirable, or dynamic auto mode, but will remain an access link if the other end is set to access. They should also know that dynamic desirable is a Cisco-proprietary feature and will not work with non-Cisco equipment.

## Real-life example

Think of two coworkers, Alice and Bob, who work in different departments and often need to share both personal mail and department documents. Each has a mailbox that can be set to either receive only one type of mail or multiple types. Alice is very outgoing, so she sets her mailbox to dynamic desirable. This means every time Bob puts a letter in his mailbox to send, Alice's mailbox sends a message back saying, hey, do you want to exchange multiple types of mail? If Bob's mailbox is set to trunk mode, meaning it is ready to handle all types, they start exchanging personal letters, memos, and project files all together. If Bob's mailbox is set to dynamic auto, it just waits but replies yes when asked, so they also form a multi-mail exchange. But if Bob's mailbox is set to access mode, meaning it only handles one type of mail, Alice's mailbox gets a no, and they only send one type of letter. This saves Alice from having to manually go to Bob and ask every time they set up a new connection. In an office, you might have many such connections between different desks or between floors. Using dynamic desirable everywhere would mean that anytime two switches are connected, they automatically establish a trunk if both support it. However, if an untrusted device like a visitor’s laptop is plugged into a port set to dynamic desirable, that laptop might be tricked into forming a trunk, giving the visitor access to all network VLANs. That is why, just like you would not set your mailbox to automatically offer to share all your mail with strangers, network engineers usually set ports connected to unknown devices to access mode only. The analogy here extends to the fact that the protocol used, DTP, is like a constant background chatter the mailbox sends a hello message every 30 seconds. If the other mailbox is silent, no trunk forms. But if they reply, the trunk is up and running within seconds. This is important for dynamic environments where switches are frequently added or moved, but it is less secure than manually deciding which links should be trunks.

## Why it matters

In practical IT work, dynamic desirable matters because it directly impacts how network traffic flows between switches and how VLANs are extended across the network. When you connect two switches, a trunk link is required if you want traffic from multiple VLANs to pass between them. Without a trunk, only one VLAN’s traffic can cross the link. Dynamic desirable automates this negotiation, which can save time in large networks where many inter-switch links need to be configured. However, it also introduces a layer of unpredictability. If a switch port is mistakenly left in dynamic desirable mode and connected to an end device like a printer, that printer might receive DTP frames and, though it won't form a trunk, the switch will keep trying, wasting processing cycles and potentially causing confusion in troubleshooting. More critically, dynamic desirable is a security vulnerability. An attacker who gains physical access to a switch port set to dynamic desirable can plug in a device that sends DTP frames pretending to be a switch. The switch will then form a trunk with the attacker's device, giving the attacker access to all VLANs on that switch. This is a well-known VLAN hopping attack. For this reason, the CCNA curriculum and industry best practices strongly recommend disabling DTP on all access ports and setting them to access mode with the switchport nonegotiate command. On trunk ports, it is safer to statically configure trunk mode and disable DTP to prevent any accidental renegotiation. Understanding dynamic desirable is therefore not just about passing an exam question, but about making informed decisions in network design. Network engineers must weigh the convenience of automatic trunking against the security risks. In enterprise environments, you will rarely see dynamic desirable used on production ports. It is more common in lab setups or smaller networks where the risk is low and ease of use is prioritized. The also affects how spanning tree protocol (STP) behaves, as trunk links may carry multiple VLANs and STP must account for that. In a network where ports dynamically change between access and trunk, STP recalculations can occur, potentially causing brief outages. So while dynamic desirable seems like a helpful feature, in practice it often creates more problems than it solves. The takeaway for IT professionals is to know when to use it, and more importantly, when not to use it.

## Why it matters in exams

The concept of dynamic desirable is a core topic for the CCNA exam, specifically under the network access and IP connectivity domains. The exam objectives require candidates to understand the differences between various switchport modes, how DTP works, and the security implications of each mode. In CCNA 200-301, candidates are expected to know that switchport mode dynamic desirable is one of the options for VLAN trunking configuration. Multiple-choice questions often ask about which combinations of modes result in a trunk or an access link. For example, a common question might state that Switch A has a port set to dynamic desirable and Switch B has a port set to dynamic auto, and ask what the resulting link type will be. The correct answer is trunk, because dynamic desirable actively asks and dynamic auto agrees. Another frequent question is about the security risk of leaving a port in dynamic desirable mode, linking it to VLAN hopping attacks. Troubleshooting questions might present a scenario where a link between two switches is not forming a trunk, and the candidate must check the DTP configuration on both ends. The exam also tests the knowledge that DTP is Cisco proprietary, so dynamic desirable will not work with third-party switches. In simulation or lab questions, candidates may be asked to configure a trunk between two switches. The correct solution might involve setting both sides to trunk mode or one side to dynamic desirable and the other to dynamic auto, but the safest answer for the exam is to use static trunk configuration. The CCNA also covers the switchport nonegotiate command, which disables DTP and prevents any negotiations. Candidates need to know that dynamic desirable is incompatible with switchport nonegotiate, and that using nonegotiate overrides any dynamic mode. Questions might also involve scenarios where a user reports that a device on an access port can only communicate with certain VLANs, and the candidate must identify that the port is accidentally forming a trunk due to DTP. The exam expects a clear understanding that dynamic desirable is more aggressive than dynamic auto. For the CCNA, dynamic desirable appears most frequently in the 2.0 Network Access section, specifically in the 2.3 Configure and verify VLANs and trunking objective. It is also touched on in security sections regarding VLAN hopping. Therefore, to excel in the CCNA, you must memorize the outcome matrix of trunk, access, dynamic desirable, and dynamic auto modes. A helpful mnemonic is DTP wants to Trout (trunk) and will ask if you want to Auto also (dynamic auto agrees). Pay attention: the only combination that does NOT form a trunk is access with access, or dynamic auto with dynamic auto? Actually, dynamic auto with dynamic auto will remain an access link because both wait for the other to speak first. So the full matrix is essential. This topic is not just limited to the CCNA but is also useful for other Cisco certification tracks like ENCOR, but for the CCNA it remains a primary objective.

## How it appears in exam questions

In the CCNA exam, dynamic desirable appears in several question formats. One common type is the matrix completion question. You might be given a table with switchport modes for two connected interfaces, and you have to determine the resulting link state trunk or access. For example, Switch 1 port: dynamic desirable, Switch 2 port: dynamic auto. The answer is trunk. Another pattern is the security-related question: A network administrator notices that an end-user workstation is able to communicate with devices on multiple VLANs. What is the most likely cause? Answer: The switch port is set to dynamic desirable mode, and the workstation is sending DTP frames to form a trunk. This tests understanding of VLAN hopping. Another type is the configuration command question: Which switchport mode should be configured to ensure that a port actively attempts to form a trunk? The answer is dynamic desirable. Troubleshooting scenarios are also common: An engineer connects two switches, but the link remains an access link. The engineer checks both ports: one is set to dynamic auto, the other to dynamic desirable. Is this correct? The answer is that it should form a trunk, so the issue lies elsewhere, perhaps in mismatched trunk encapsulation or a disabled DTP. Some questions show a show running-config output where one port is set to dynamic desirable and another to access, and ask what the link state will be. The answer is access, because the access mode port refuses trunk negotiation. There are also drag-and-drop questions where you match the mode to the behavior. For instance, dynamic desirable: actively sends DTP frames; dynamic auto: listens for DTP frames; trunk: always trunks; access: never trunks. The exam may also present a simulation where you must configure two switches to form a trunk using the most secure method. In that case, you would configure both ends as trunk mode and possibly disable DTP with switchport nonegotiate. If the question says to use negotiation, you might set one end to dynamic desirable and the other to dynamic auto, but you must type the correct commands. The command is interface configuration mode: switchport mode dynamic desirable. Note that it is switchport mode dynamic desirable and not just dynamic desirable. The encapsulation must be set to dot1q if the switch supports ISL as well, though newer switches only support dot1q. In some older exam questions, the distinction between ISL and dot1q is tested, but in current CCNA 200-301, only 802.1Q is used. Another common trap: a candidate might think that dynamic desirable will form a trunk with a port set to access if the access port receives DTP frames but the answer is no. Access mode ports ignore DTP and stay in access mode. Understanding this difference is crucial. Overall, dynamic desirable is not a trick topic but requires memorization of a small table of outcomes. Practice with that table until it is second nature, and you will handle these questions confidently.

## Example scenario

Imagine you are setting up a small office network with two Cisco switches. Switch A is on the first floor, Switch B is on the second floor. You have three VLANs: VLAN 10 for sales, VLAN 20 for engineering, and VLAN 30 for management. You need traffic from all three VLANs to travel between the two switches so that sales on floor 1 can talk to sales on floor 2, and so on. To achieve this, you need a trunk link between the two switches. You decide to use dynamic desirable on one side because you are not sure how the other switch will be configured. You log into Switch A and configure interface GigabitEthernet0/1 with the command switchport mode dynamic desirable. On Switch B, you configure the same interface with switchport mode dynamic auto. After you connect the cable and wait a few seconds, you check the interface status. Using the command show interfaces trunk, you see that the port is now a trunk, carrying VLANs 10, 20, and 30. This works because dynamic desirable on Switch A actively sent DTP frames to Switch B. Switch B, being in dynamic auto mode, replied yes to the trunk request. The link becomes operational as a trunk. Now think about a different scenario. Suppose on Switch B you mistakenly configure the port as an access port in VLAN 1. In that case, even though Switch A is sending DTP frames, Switch B's port will simply ignore them and remain in access mode. The link will only carry VLAN 1 traffic, and devices on VLANs 10 and 20 on floor 1 will not be able to reach their counterparts on floor 2. This would cause a network outage for those VLANs. You could troubleshoot by checking the running configuration on both switches, noticing the mismatch, and correcting Switch B to a trunk or dynamic mode. Another scenario highlights security. Imagine an attacker in the office finds an unused wall jack connected to Switch A. That port is accidentally left in dynamic desirable mode. The attacker plugs in a laptop that can send DTP frames. The laptop pretends to be a switch by sending DTP frames requesting a trunk. Switch A, seeing the request from its dynamic desirable port, will negotiate a trunk with the laptop. Now the attacker's laptop has access to all VLANs passing through Switch A, including the management VLAN 30. This is a serious breach. The simple fix is to configure all end-user ports as static access ports and disable DTP with switchport nonegotiate. In your scenario, you learn that while dynamic desirable is convenient for dynamic environments, it must be used only on ports connecting to other trusted switches.

## Common mistakes

- **Mistake:** Thinking dynamic desirable will form a trunk with a port set to access mode
  - Why it is wrong: An access mode port does not participate in DTP negotiation. It will not respond to DTP frames and will remain in access mode, even if the other end is set to dynamic desirable. The link will stay as an access link.
  - Fix: Remember that access mode ports do not trunk. Only trunk, dynamic desirable, and dynamic auto modes negotiate trunks.
- **Mistake:** Confusing dynamic desirable with dynamic auto
  - Why it is wrong: Dynamic desirable actively sends DTP frames to ask for a trunk, while dynamic auto only listens and responds if asked. Many learners think both behave the same, but dynamic desirable is the initiator. If both ends are dynamic auto, no trunk forms because both wait for the other to speak.
  - Fix: Use a memory trick: Desirable is Desirous to trunk (it asks first). Auto just responds.
- **Mistake:** Assuming dynamic desirable works with non-Cisco switches
  - Why it is wrong: DTP is a Cisco proprietary protocol. Non-Cisco switches do not understand DTP frames. If you connect a Cisco switch port in dynamic desirable to a third-party switch, the third-party switch will ignore the DTP frames and no trunk will form, leaving the link as an access link by default.
  - Fix: When connecting to non-Cisco equipment, manually configure the trunk (or access) mode and disable DTP.
- **Mistake:** Forgetting to also configure trunk encapsulation when using older switches
  - Why it is wrong: On older Cisco switches that support both ISL and 802.1Q, dynamic desirable negotiates the encapsulation as well. If the two ports do not support the same encapsulation, the trunk fails. For example, one port only supports ISL and the other only dot1q, the trunk will not form even if both are in dynamic desirable mode.
  - Fix: Set the encapsulation to dot1q explicitly on interfaces that will trunk, or ensure both switches support the same encapsulation type.
- **Mistake:** Assuming dynamic desirable is more secure than dynamic auto
  - Why it is wrong: Both dynamic desirable and dynamic auto are unsafe for ports connected to untrusted devices because DTP can be exploited. In fact, dynamic desirable is even more dangerous because it actively sends DTP frames, making it easier for an attacker to initiate a trunk from the other side with a simple DTP frame.
  - Fix: Use access mode with switchport nonegotiate on end-user ports. Only use dynamic desirable on links between trusted switches, if at all.

## Exam trap

{"trap":"Many learners choose the answer that 'dynamic desirable will form a trunk with dynamic auto' but then incorrectly think that 'dynamic auto with dynamic auto' also forms a trunk because both are 'dynamic'.","why_learners_choose_it":"The word 'dynamic' in both modes makes learners assume they behave similarly. They do not realize that dynamic auto is passive and needs the other side to initiate DTP. Without an initiator, no trunk forms.","how_to_avoid_it":"Create a small mental table: dynamic desirable = asks first; dynamic auto = waits to be asked; trunk = always says yes; access = always says no. Then remember: if neither side asks first (both auto), no trunk. Practice with flashcards for the four possible combinations that yield a trunk: trunk+trunk, trunk+desirable, trunk+auto, desirable+desirable, desirable+auto."}

## Commonly confused with

- **Dynamic desirable vs Dynamic auto:** Dynamic auto is a passive DTP mode that will form a trunk only if the remote port actively requests it by being in trunk or dynamic desirable mode. Dynamic desirable actively sends DTP frames and requests a trunk. The key difference is that dynamic desirable initiates the conversation, while dynamic auto only listens. (Example: If both switches are set to dynamic auto, no trunk forms. If one is set to dynamic desirable and the other to dynamic auto, a trunk forms.)
- **Dynamic desirable vs Access mode:** Access mode configuration makes a port a non-trunking port that carries traffic for only one VLAN. It does not participate in DTP negotiation at all. Dynamic desirable always tries to negotiate a trunk, while access mode refuses any trunking attempt. (Example: Connecting a port in dynamic desirable to a port in access mode results in an access link, not a trunk.)
- **Dynamic desirable vs Trunk mode:** Trunk mode statically forces the port to become a trunk regardless of the other side's configuration (within reason). Dynamic desirable is a negotiated mode that can become either a trunk or an access link depending on the other device. Trunk mode is deterministic; dynamic desirable is conditional. (Example: If one port is trunk and the other is access, the trunk mode port will still try to trunk, but the other side won't cooperate, so the link may not work correctly. That's why trunk mode is usually paired with another trunk or a dynamic mode.)
- **Dynamic desirable vs Switchport nonegotiate:** Switchport nonegotiate disables DTP on an interface, preventing any trunk negotiation. This is often used with access mode to secure ports. Dynamic desirable relies on DTP, so the two settings are mutually exclusive. If you configure nonegotiate, the port cannot use dynamic desirable to form a trunk. (Example: A port configured with switchport mode access and switchport nonegotiate will never send or receive DTP frames, ensuring it remains an access port.)

## Step-by-step breakdown

1. **Identify the interface** — First, you select the switch port you want to configure. This is usually a physical port like GigabitEthernet0/1. You enter interface configuration mode using the command 'interface GigabitEthernet0/1'. This tells the switch which port you are going to work on.
2. **Set the switchport mode to dynamic desirable** — You type 'switchport mode dynamic desirable' in the interface configuration. This command tells the switch to use DTP to actively negotiate a trunk. The port will send DTP frames every 30 seconds asking the connected device if it wants to trunk.
3. **Connect the cable and wait for DTP negotiation** — When a cable is connected, DTP frames start flowing. The port in dynamic desirable sends a DTP hello to the other device. The other device responds based on its own configuration. This negotiation happens in a few seconds.
4. **Check the resulting link state** — Use 'show interfaces trunk' or 'show interfaces switchport' command to see if the link became a trunk or remains an access link. If the other end is trunk, dynamic desirable, or dynamic auto, the link will show as trunking. If it is access, it shows as access.
5. **Secure the port if necessary** — After negotiation, consider whether this port should be a trunk. If it is an access port, change the mode to access and disable DTP with 'switchport nonegotiate' to prevent future attacks. If it is a trunk and you want a static configuration, change the mode to trunk and optionally disable DTP.
6. **Document the configuration** — Record which ports are using dynamic desirable so that when troubleshooting or performing security audits, you know which links may be at risk. In production, dynamic desirable is often replaced with static configurations for predictability and security.

## Practical mini-lesson

Dynamic desirable is a configuration tool, not a set-it-and-forget-it feature. In the real world, you will rarely see it on a production network, but understanding it fully is critical for the CCNA and for troubleshooting unexpected trunk formation. When you configure dynamic desirable, you are telling the switch to use DTP to actively seek a trunk. This is useful in lab environments where you quickly connect two switches and want them to trunk without extra commands. For instance, if you have a stack of switches in a lab and you frequently change topologies, using dynamic desirable saves time. However, in a production environment, a common practice is to configure all ports that connect to other switches as static trunks and disable DTP. All ports that connect to end devices are set to static access with DTP disabled. This eliminates the risk of VLAN hopping and gives you full control. Now, let's walk through a real configuration scenario. You have two Cisco 2960 switches. You want to connect them with a trunk. On Switch 1, you go to interface Gi0/24 and type: switchport mode dynamic desirable. On Switch 2, you do the same, or you use dynamic auto. After connecting the cable, you verify with: show interfaces trunk. The output should show Gi0/24 as trunking. If it doesn't, you check if DTP is enabled (by default it is) and that the encapsulation matches (both should be dot1q). In newer switches, switchport trunk encapsulation dot1q might be required if the switch supports multiple encapsulations. In many Cisco switches, the default encapsulation is already dot1q, so you may not need to set it. But you should know the command. Another practical point: You can test DTP behavior by configuring one port as dynamic desirable and another as dynamic auto. Then capture DTP packets using Wireshark on a SPAN port. You will see the DTP multicast frames. This is a good way to see the protocol in action. What can go wrong? A common issue is that an operator sets a port to dynamic desirable but the connected device is a router that doesn't support DTP. In that case, the router will ignore DTP, and the switch port will stay as an access port. The router might still work, but only if it is in the same VLAN as the native VLAN. This can cause connectivity problems for devices in other VLANs. Another issue is a mismatch in DTP settings between two switches that causes the link to flap between access and trunk. This might happen if one side is dynamic desirable and the other is switchport nonegotiate (which disables DTP). In that case, DTP frames are not exchanged, and the link will be an access link. However, the switch in dynamic desirable mode might keep trying, but no negotiation happens. This can cause high CPU usage on the switch due to constant DTP frames. To troubleshoot, use show interfaces switchport to see the operational mode. If you see it is access but you expected trunk, check the other side's config. Dynamic desirable is a convenient but insecure feature. As a professional, you should know how to configure, verify, and, most importantly, secure ports against its misuse. In exams, they expect you to know the DTP outcome matrix and identify security risks.

## Memory tip

Desirable DTP: Desirable actively Desires a Trunk, so it asks first. Auto waits for an invite. Trunk says yes to anything. Access says no.

## FAQ

**What is the difference between dynamic desirable and dynamic auto?**

Dynamic desirable actively sends DTP frames to ask if the other device wants to form a trunk, while dynamic auto only responds to DTP frames but does not initiate the request. If both ends are dynamic auto, no trunk forms.

**Can dynamic desirable form a trunk with a port in access mode?**

No. An access mode port does not participate in DTP negotiation and will remain as an access port, so the link stays as an access link.

**Is dynamic desirable a Cisco proprietary feature?**

Yes. DTP is a Cisco proprietary protocol, so dynamic desirable only works when connecting to another Cisco switch that supports DTP.

**Why is dynamic desirable considered a security risk?**

An attacker can connect a device that sends DTP frames, and the switch will negotiate a trunk, giving the attacker access to all VLANs. This is called VLAN hopping.

**How do I disable DTP on a port configured with dynamic desirable?**

You can use the 'switchport nonegotiate' command in interface configuration mode. This prevents DTP frames from being sent or processed. However, note that 'nonegotiate' overrides the dynamic desirable setting, so the port will not form a trunk.

**Do I need to configure trunk encapsulation explicitly when using dynamic desirable?**

On modern switches that only support 802.1Q, the encapsulation is automatic. On older switches that support both ISL and 802.1Q, you may need to set the encapsulation to dot1q using 'switchport trunk encapsulation dot1q' before or after the mode command.

## Summary

Dynamic desirable is a Cisco switch port mode that uses the Dynamic Trunking Protocol to actively negotiate a trunk link with a connected device. If the other device is configured with trunk, dynamic desirable, or dynamic auto mode, a trunk forms and carries traffic for multiple VLANs. If the other device is in access mode, the link remains an access link, carrying only one VLAN. This automation can simplify network setup in dynamic environments, but it introduces security vulnerabilities, most notably the risk of VLAN hopping attacks where an attacker can trick the switch into forming a trunk and gain access to multiple VLANs. The CCNA exam expects you to understand the DTP negotiation outcomes: which mode combinations result in a trunk versus an access link, and the security implications. You must also know that dynamic desirable is a Cisco proprietary feature and will not work with non-Cisco equipment. In practice, network professionals typically disable DTP on all ports and use static configurations access or trunk to enhance security and predictability. The key takeaway is that dynamic desirable is a useful learning concept and a valid exam topic, but in real-world enterprise networks it is rarely used due to the security risks. For your exam, memorize the DTP outcome matrix: trunk and any dynamic mode or trunk works; dynamic desirable with dynamic auto works; dynamic auto with dynamic auto fails. Also remember that dynamic desirable is the most aggressive mode, actively sending DTP frames. With this knowledge, you will be well prepared for any CCNA question on this topic.

---

Practice questions and the full interactive page: https://courseiva.com/glossary/dynamic-desirable