Content

| 2.4 |  | Configuring VLANs and VMPS |
| 2.4.4 |  | VMPS operation |

With VLAN Membership Policy Server (VMPS), switch ports can be assigned to VLANs dynamically, based on the source MAC address or user ID of the device connected to the port. When a host or user moves from a port on one switch in the network to a port on another switch in the network, the switch dynamically assigns the new port to the proper VLAN for that host.

When VMPS is enabled, a MAC address-to-VLAN mapping database downloads from a Trivial File Transfer Protocol (TFTP) server to the VMPS server (a Catalyst switch). The VMPS server then begins accepting client requests.

The VMPS client communicates with a VMPS server through the VLAN Query Protocol (VQP). When the VMPS receives a VQP request from a client switch, it searches its database for a MAC-address-to-VLAN mapping.

The server response is based on this mapping and whether or not the server is in secure mode. Secure mode determines whether the server shuts down the port when a VLAN is not allowed on it or just denies the port access to the VLAN.

In response to a request, the VMPS takes one of these actions:

- If the assigned VLAN is restricted to a group of ports, the VMPS verifies the requesting port against this group and responds as follows:

> - If the VLAN is allowed on the port, the VMPS sends the VLAN name to the client in response.
> - If the VLAN is not allowed on the port and the VMPS is not in secure mode, the VMPS sends an access-denied response.
> - If the VLAN is not allowed on the port and the VMPS is in secure mode, the VMPS sends a port-shutdown response.

- If the VLAN in the database does not match the current VLAN on the port and active hosts exist on the port, the VMPS sends an access-denied or a port-shutdown response, depending on the secure mode of the VMPS.

If the switch receives an access-denied response from the VMPS, it continues to block traffic from the MAC address to or from the port. The switch continues to monitor the packets directed to the port and sends a query to the VMPS when it identifies a new address. If the switch receives a port-shutdown response from the VMPS, it disables the port. The port must then be enabled manually.

It is also possible to configure a fallback VLAN name. If a device is plugged into the network and its MAC address is not in the database, VMPS sends the fallback VLAN name to the client. If no fallback VLAN is configured and the MAC address does not exist in the database, VMPS sends an access-denied response. If VMPS is in secure mode, it sends a port-shutdown response.

An administrator can also make an explicit entry in the configuration table to deny access to specific MAC addresses for security reasons by specifying a --NONE-- keyword for the VLAN name. In this case, VMPS sends an access-denied or port-shutdown response.

Dynamic Port VLAN Membership
A dynamic port on the switch can belong to only one VLAN. When the link comes up, the switch does not forward traffic to or from this port until the VMPS server provides the VLAN assignment. The VMPS client receives the source MAC address from the first packet of a new host connected to the dynamic port and attempts to match the MAC address to a VLAN in the VMPS database via a VQP request to the VMPS server.

If there is a match, the VMPS server sends the VLAN number for that port. If the client switch was not previously configured, it uses the domain name from the first VTP packet it receives on its trunk port from the VMPS. If the client switch was previously configured, it includes its domain name in the query packet to the VMPS to obtain its VLAN number. The VMPS verifies that the domain name in the packet matches its own domain name before accepting the request and responds to the client with the assigned VLAN number for the client. If there is no match, the VMPS either denies the request or shuts down the port, depending on the VMPS secure mode setting.

Multiple hosts can be active on a dynamic port if they are all in the same VLAN, but the VMPS shuts down a dynamic port if more than 20 hosts are active on the port for a Catalyst 2950 or 3550 switch. The total number of allowable hosts varies by platform.

If the link goes down on a dynamic port, the port returns to an isolated state and does not belong to a VLAN. Any hosts that come online through the port are checked again through the VQP with the VMPS before the port is assigned to a VLAN.