Hands-On Lab: Restricting Allowed VLANs on Trunks and Changing VTP Version

Lab Objective

Restrict a trunk link to carry only specific VLANs rather than every VLAN configured on the switch, verify the restriction takes effect, and then change the switch's VTP version while confirming the operation succeeds without disrupting the existing VLAN database.

Lab Purpose

By default, a trunk carries every VLAN known to the switch, which can unnecessarily expose broadcast traffic and security-sensitive VLANs across links that do not actually need them. Restricting allowed VLANs is standard practice on any trunk connecting to a switch that does not need every VLAN present.

Lab Topology

Switch1 ---- Gi1/0/24 (trunk to a remote-office
             switch that only needs VLANs 10 and 20)

Switch1 currently has VLANs 1, 10, 20, 30, and
999 configured, all carried on the trunk by default

Task 1: Verify the Current Trunk Allows All VLANs

Confirm the trunk currently carries every VLAN on the switch.

Task 2: Restrict the Trunk to Only VLANs 10 and 20

Configure the trunk to permit only VLANs 10 and 20.

Task 3: Verify the Restriction

Confirm the trunk now shows only the permitted VLANs.

Task 4: Change the VTP Version

Change Switch1's VTP version from 1 to 2, and confirm the operation succeeds and the existing VLAN database is preserved.

Solution and Verification

Switch1# show interfaces trunk

Port      Vlans allowed on trunk
Gi1/0/24  1,10,20,30,999

Switch1(config)# interface gigabitethernet1/0/24
Switch1(config-if)# switchport trunk allowed vlan 10,20

Switch1# show interfaces trunk

Port      Vlans allowed on trunk
Gi1/0/24  10,20

-- VLANs 1, 30, and 999 will no longer cross
-- this specific trunk, even though they still
-- exist in the switch's own VLAN database

Switch1# show vtp status | include Version

VTP version running    : 1

Switch1(config)# vtp version 2

Switch1# show vtp status | include Version

VTP version running    : 2

Switch1# show vlan brief

VLAN Name       Status    Ports
---- ---------- --------- -----
1    default    active
10   Accounting active
20   Marketing  active
30   Engineering active
999  NativeUnused active
-- All previously configured VLANs remain
-- intact after the version change

Key Takeaway

Restricting allowed VLANs on a trunk operates entirely independently from the switch's own VLAN database — a VLAN can exist locally on a switch while being deliberately excluded from a specific trunk link, giving fine-grained control over exactly which broadcast domains extend across each individual connection.