Content

| 2.3 |  | VLAN Types |
| 2.3.6 |  | Dynamic VLANs |

With a VLAN Management Policy Server (VMPS), ports can be assigned to VLANs dynamically, based on information entered in the VMPS database. When a host moves from a port on one switch in the network to a port on another switch in the network, the switch assigns the new port to the proper VLAN for that host dynamically.

When VMPS is enabled, a MAC address-to-VLAN mapping database downloads from a Trivial File Transfer Protocol (TFTP) server and VMPS begins to accept client requests. If the switch is power cycled or reset, the VMPS database downloads from the TFTP server automatically and VMPS is reenabled.

VMPS opens a User Datagram Protocol (UDP) socket to communicate and listen to client requests. When the VMPS server receives a valid request from a client, it searches its database for a MAC address-to-VLAN mapping.

If the assigned VLAN is restricted to a group of ports, VMPS verifies the requesting port against this group. If the VLAN is allowed on the port, the VLAN name is returned to the client. If the VLAN is not allowed on the port and VMPS is not in secure mode, the host receives an "access-denied" response. If VMPS is in secure mode, the port is shut down.

If a VLAN in the database does not match the current VLAN on the port and active hosts are on the port, VMPS sends an access-denied or a port-shutdown response based on the secure mode of the VMPS.

Multiple hosts can be active on a dynamic port if they are all in the same VLAN. If the link goes down on a dynamic port, the port returns to an isolated state. Any hosts that come on line through the port are checked again with VMPS before the port is assigned to a VLAN.

The following guidelines and restrictions apply to dynamic port VLAN membership:

- VMPS must be configured before the ports can be configured as dynamic.
- When a port is configured as dynamic, spanning tree PortFast is enabled automatically for that port.
- If a port is converted from static to dynamic on the same VLAN, the port connects immediately to that VLAN, but VMPS will eventually check the legality of the host on the port.
- Static secure ports cannot become dynamic ports unless security is disabled before making the port dynamic.
- Static ports that are trunking cannot become dynamic ports unless trunking is disabled on the port before changing it from static to dynamic.

It is also important to note that the VLAN Trunking Protocol (VTP) management domain and the management VLAN of VMPS clients and the VMPS server must be the same.