VTP Pruning – Any Reason Not to Use It?

Depending on how the service is delivered by the SP will dictate how you can separate the services on your end.

Typical methods are either a port per service or a VLAN tag per service.

If the SP is tagging the traffic you can just set up your switch to trunk to the SP and then separate the traffic into two access ports (one to FW and one to LAN).

If it's a port per service then just create two VLANs with the services in different VLANs for isolation.

That’s because VTP functions on a client/server model, not a distributed model. The server effectively controls everything that happens inside the VTP domain. When a switches directly connected port/downstream port, it sends a VTP Join message indicating participation in that VLAN.

If you wanted something similar to a distributed model that supports VLAN pruning across links, you would be looking at something similar to GVRP, which is pretty difficult to come by in the Cisco world these days (aside from CatOS). I would assume this is because they’re trying to push VTP a lot harder.

I am trying to understand why a client switch can't run vtp pruning.

Keep in mind that every switch running VTP (client or server) will prune if told to do so. This is not default behaviour, VTP comes disabled. Otherwise, scenarios like below would not function as expected.

If Switch 4 was the only device pruning, all other downstream switches would be needlessly spammed when expected not to.