Content

| 2.4 |  | Configuring VLANs and VMPS |
| 2.4.5 |  | VMPS configuration guidelines |

There are several restrictions for configuring VMPS client switch ports as dynamic. The following requirements apply to dynamic port VLAN membership:

- VMPS must be configured before ports can be set as dynamic.
- The VTP management domain of the VMPS clients and the VMPS server must be the same.
- The management VLAN of VMPS clients and the VMPS server must be the same.
- When a port is configured as dynamic, the spanning-tree Port Fast feature is automatically enabled for that port.
- After a static port is converted to dynamic on the same VLAN, the port connects immediately to that VLAN until VMPS checks its database for the legality of the specific host on the dynamic port.
- Static ports cannot become dynamic ports.
- Static ports that are trunking cannot become dynamic ports.
- Physical ports in an EtherChannel cannot be configured as dynamic ports.
- VMPS shuts down a dynamic port when too many active hosts connect to a port.

In order to use VMPS, a VMPS database must be created and stored on a TFTP server.

A VMPS database configuration file is an ASCII text file that is stored on a TFTP server accessible to the switch configured as the VMPS server.

The VMPS parser is line-based. Each entry in the text file starts on a new line.

Ranges are not allowed for the switch port numbers. It is probably easiest to take a sample VMPS database file and edit it to meet the needs of the network.

While this is rarely done, a VMPS database file can be created from scratch using these rules:

- Begin the configuration file with the word "VMPS", to prevent other types of configuration files from incorrectly being read by the VMPS server.
- Define the VMPS domain.
- Define the security mode as either open (the default) or secure mode.
- Define a fallback VLAN. (optional)
- Define the MAC address-to-VLAN name mappings.
- Define port groups to which VMPS will be applied, using groups, individual ports, or the all-ports keyword.
- Define VLAN groups to which VLAN port policies will be applied.
- Define VLAN port policies to associate ports with a restricted VLAN.

To review the general mechanism by which VMPS makes policy decisions affecting switch ports and VLAN assignments, review the earlier section “VMPS Operation”. A summary of the sample VMPS configuration file follows:

- The security mode is open.
- The default is used for the fallback VLAN.
- MAC address-to-VLAN name mappings provide the MAC address of each host and the VLAN to which each host belongs is defined.
- Port groups are defined.
- VLAN groups are defined.
- VLAN port policies are defined for the ports associated with restricted VLANs.

To create a VMPS database, first determine the MAC addresses of the hosts that will be assigned to VLANs dynamically and determine the VMPS mode Then map out the port-groups, VLAN-groups, port-policies, and fallback VLAN. Next, create an ASCII text file that contains the MAC address-to-VLAN mappings and policies. Lastly, move the ASCII text file to a TFTP server so it can be downloaded to the switch that will act as the VMPS server.

As soon as the VMPS database is in place on the TFTP server, the VMPS server and clients can be configured.

Recall that when VMPS is enabled, the switch downloads the VMPS database from the TFTP server and begins accepting VMPS requests from VMPS clients.

Configure VMPS clients with the following commands starting in global configuration mode:

> Switch#configure terminal
> Switch(config)#vmps server ipaddress primary
> Switch(config)#vmps server ipaddress for up to 3 secondary VMPS servers (optional)
> Switch(config)#interface interface
> Switch(config-if)#switchport mode access
> Switch(config-if)#switchport access vlan dynamic

Repeat the last 3 commands for each dynamic switch port. To reenable a shutdown dynamic port, enter the interface configuration command no shutdown.

Now that all of the VMPS components configured and in place, verify that everything is working correctly.

Use the show vmps command to verify the VMPS server entry. This command did not become available on some IOS-based switch platforms until IOS Release 12.1(6). This command displays the VQP version and the VMPS server IP addresses, including which server is the primary. Use the statistics keyword to display client-side statistics.

Use the command show interface interface switchport to verify dynamic assignment of VLAN membership to a given port.

Once the database has loaded, a VMPS server switch answers queries from VMPS client switches with dynamic ports. The following assumptions apply to this scenario:

- The VMPS server and the VMPS client are separate switches.
- Switch 1 is the primary VMPS server.
- Switch 3 and Switch 10 are secondary VMPS servers.
- End stations are connected to these clients:

> - Switch 5
> - Switch 8

- The database configuration file is called Bldg-G.db and is stored on a TFTP server with IP address 172.20.22.7.