Hands-On Lab: Restricting Allowed VLANs on Trunks and Changing VTP Version

This hands-on lab covers restricting which VLANs are permitted to cross a specific trunk link, preventing unnecessary broadcast traffic and improving security, and separately covers safely changing a switch's VTP version within an existing domain.

Trunk Allowed VLANsVTP Version ChangeTrunk Traffic Restriction

Lab Objective

Restrict a trunk link to carry only specific VLANs rather than every VLAN configured on the switch, verify the restriction takes effect, and then change the switch's VTP version while confirming the operation succeeds without disrupting the existing VLAN database.

Lab Purpose

By default, a trunk carries every VLAN known to the switch, which can unnecessarily expose broadcast traffic and security-sensitive VLANs across links that do not actually need them. Restricting allowed VLANs is standard practice on any trunk connecting to a switch that does not need every VLAN present.

Lab Topology

Switch1 ---- Gi1/0/24 (trunk to a remote-office
             switch that only needs VLANs 10 and 20)

Switch1 currently has VLANs 1, 10, 20, 30, and
999 configured, all carried on the trunk by default

Task 1: Verify the Current Trunk Allows All VLANs

Confirm the trunk currently carries every VLAN on the switch.

Task 2: Restrict the Trunk to Only VLANs 10 and 20

Configure the trunk to permit only VLANs 10 and 20.

Task 3: Verify the Restriction

Confirm the trunk now shows only the permitted VLANs.

Task 4: Change the VTP Version

Change Switch1's VTP version from 1 to 2, and confirm the operation succeeds and the existing VLAN database is preserved.

Solution and Verification

Switch1# show interfaces trunk

Port      Vlans allowed on trunk
Gi1/0/24  1,10,20,30,999

Switch1(config)# interface gigabitethernet1/0/24
Switch1(config-if)# switchport trunk allowed vlan 10,20

Switch1# show interfaces trunk

Port      Vlans allowed on trunk
Gi1/0/24  10,20

-- VLANs 1, 30, and 999 will no longer cross
-- this specific trunk, even though they still
-- exist in the switch's own VLAN database

Switch1# show vtp status | include Version

VTP version running    : 1

Switch1(config)# vtp version 2

Switch1# show vtp status | include Version

VTP version running    : 2

Switch1# show vlan brief

VLAN Name       Status    Ports
---- ---------- --------- -----
1    default    active
10   Accounting active
20   Marketing  active
30   Engineering active
999  NativeUnused active
-- All previously configured VLANs remain
-- intact after the version change

Key Takeaway

Restricting allowed VLANs on a trunk operates entirely independently from the switch's own VLAN database — a VLAN can exist locally on a switch while being deliberately excluded from a specific trunk link, giving fine-grained control over exactly which broadcast domains extend across each individual connection.

Hands-On Lab: Restricting Allowed VLANs on Trunks and Changing VTP Version

Lab Objective

Lab Purpose

Lab Topology

Task 1: Verify the Current Trunk Allows All VLANs

Task 2: Restrict the Trunk to Only VLANs 10 and 20

Task 3: Verify the Restriction

Task 4: Change the VTP Version

Solution and Verification

Key Takeaway

Related Articles

Hands-On Lab: Assigning Spanning Tree Priority to Multiple VLANs Simultaneously

Hands-On Lab: Configuring Spanning Tree Root Bridges Using the IOS Macro Command

Hands-On Lab: Configuring Spanning Tree Protocol Root Bridges Manually

Hands-On Lab: Verifying Spanning Tree Port States on Catalyst Switches

Hands-On Lab: Changing the Native VLAN and Shutting Down Unused Ports

Hands-On Lab: Configuring Extended VLANs on Cisco Catalyst Switches

Related Articles

Hands-On Lab: Assigning Spanning Tree Priority to Multiple VLANs Simultaneously
This hands-on lab configures Spanning Tree bridge priority across several VLANs in a single command using a VLAN range, rather than repeating the configuration individually for each VLAN, and verifies the priority was correctly applied to every VLAN in the range.
Continue

Hands-On Lab: Configuring Spanning Tree Root Bridges Using the IOS Macro Command
This hands-on lab uses the spanning-tree root primary and root secondary macro commands to configure a primary and backup root bridge without manually calculating priority values, and verifies IOS automatically selects an appropriate priority relative to the current root.
Continue

Hands-On Lab: Configuring Spanning Tree Protocol Root Bridges Manually
This hands-on lab manually influences Spanning Tree root bridge election by adjusting bridge priority on two competing switches, verifying which switch becomes root before and after the change, and confirming the resulting port roles update accordingly.
Continue

Hands-On Lab: Verifying Spanning Tree Port States on Catalyst Switches
This hands-on lab observes a switch port transitioning through the Spanning Tree Protocol states of blocking, listening, learning, and forwarding as it comes online, and covers the show commands used to check a port's current state and role.
Continue

Hands-On Lab: Changing the Native VLAN and Shutting Down Unused Ports
This hands-on lab covers changing a trunk's native VLAN away from the default VLAN 1 for security purposes, and shutting down unused switch ports as a baseline hardening practice, verifying both changes with appropriate show commands.
Continue

Hands-On Lab: Configuring Extended VLANs on Cisco Catalyst Switches
This hands-on lab covers creating VLANs in the extended range above 1005, explains why VTP version matters for supporting them, and verifies an extended VLAN functions identically to a standard-range VLAN once created.
Continue