Find the VTP primary server on a Cisco switch

"VTP VLAN configuration not allowed when device is in CLIENT mode" means VLANs are managed elsewhere. One show command tells you which switch is the VTP primary.

You try to add a VLAN on a Cisco switch and get this error:

SW03(config)# vlan 2
VTP VLAN configuration not allowed when device is in CLIENT mode.

The switch is part of a VLAN Trunking Protocol (VTP) domain in client mode. VTP is a Cisco protocol that propagates VLAN configuration from one switch to the others in the domain, so a client cannot create VLANs itself. VTP is no longer generally recommended, partly because of surprises like this one.

Find the primary server

The VTP primary server is the switch that manages the VLANs for the whole domain. Ask any switch in the domain which one it is:

SW03# show vtp status | include Primary Description
Primary Description : SW01

Here the primary server is SW01.

What to do next

  • Add the VLAN on the primary server. It propagates to the clients, including this switch.
  • Or, if you want to stop using VTP, change the mode of the switches, starting with the primary, to transparent or off. Each switch then manages its own VLANs.

Moving away from VTP is a significant change. Before you do it, check which switches rely on VTP for their VLAN configuration, and make sure you understand how VLANs and VTP work in your network.

If you have remarks or questions, leave a comment below.

Join the discussion

Comments are hosted on comments.vciso.ch, a server I run myself. Nothing is loaded from it until you press the button below. Loading comments connects your browser to that server, and signing in with GitHub sets a cookie there. See the privacy page for details.

Type to search.

↑ ↓ to move, Enter to open, Esc to close