switchport nonegotiate
Completely halts the transmission of Dynamic Trunking Protocol (DTP) frames out of a physical interface. This is a critical security hardening step to prevent malicious actors from tricking a switchport into forming an unauthorized trunk link.
Quick Reference
Switch(config-if)#mode access or mode trunkno switchport nonegotiateSyntax Breakdown
This is a standalone execution command that does not require any trailing variables or arguments.
By default, even if you statically configure a port as switchport mode trunk, the Cisco ASIC will still broadcast DTP frames into the wire every 30 seconds to let the neighbor device know it is a trunk. The nonegotiate command silences this completely, creating a true, quiet, static link.
CLI Deployment Scenarios
Scenario 1: Silencing a Core Trunk Link
You have established a hardcoded trunk between two core switches and want to disable the unnecessary DTP overhead.
Scenario 2: Hardening an Edge Access Port
You are locking down an edge port connected to a public lobby wall jack to ensure it cannot be manipulated into a trunk.
CCNA Exam Gotchas
The "Dynamic" Conflict Error
If an interface is sitting in its default dynamic auto or dynamic desirable state, and you attempt to execute switchport nonegotiate, Cisco IOS will throw a hard error: "Command rejected: Conflict between 'nonegotiate' and 'dynamic' status." You must statically define the port as access or trunk first.
Symmetrical Configuration Required
If you disable DTP on Switch A, but leave Switch B in dynamic auto mode, Switch B will never form a trunk because it is no longer receiving the DTP trigger frames from Switch A. If you use nonegotiate on a trunk, both sides of the link must be manually configured as switchport mode trunk.