Configuring Vmps; Understanding Vmps - Cisco Catalyst 2950 Software Configuration Manual

Configuring VMPS

Configuring VMPS
The Catalyst 2950 switch cannot be a VMPS server but can act as a client to the VMPS and communicate
with it through the VLAN Query Protocol (VQP). VMPS dynamically assigns dynamic access port
VLAN membership.
This section includes this information about configuring VMPS:
•
•
•
•
•
•
•

Understanding VMPS

When the VMPS receives a VQP request from a client switch, it searches its database for a
MAC-address-to-VLAN mapping. The server response is based on this mapping and whether or not the
server is in secure mode. Secure mode determines whether the server shuts down the port when a VLAN
is not allowed on it or just denies the port access to the VLAN.
In response to a request, the VMPS takes one of these actions:
•
•
If the switch receives an access-denied response from the VMPS, it continues to block traffic from the
MAC address to or from the port. The switch continues to monitor the packets directed to the port and
sends a query to the VMPS when it identifies a new address. If the switch receives a port-shutdown
response from the VMPS, it disables the port. The port must be manually re-enabled by using the CLI,
CMS, or SNMP.
You can also use an explicit entry in the configuration table to deny access to specific MAC addresses
for security reasons. If you enter the none keyword for the VLAN name, the VMPS sends an
access-denied or port-shutdown response, depending on the VMPS secure mode setting.
Catalyst 2950 Desktop Switch Software Configuration Guide
13-30
"Understanding VMPS" section on page 13-30
"Default VMPS Configuration" section on page 13-33
"VMPS Configuration Guidelines" section on page 13-33
"Configuring the VMPS Client" section on page 13-34
"Monitoring the VMPS" section on page 13-36
"Troubleshooting Dynamic Port VLAN Membership" section on page 13-37
"VMPS Configuration Example" section on page 13-37
If the assigned VLAN is restricted to a group of ports, the VMPS verifies the requesting port against
this group and responds as follows:
– If the VLAN is allowed on the port, the VMPS sends the VLAN name to the client in response.
If the VLAN is not allowed on the port and the VMPS is not in secure mode, the VMPS sends
–
an access-denied response.
If the VLAN is not allowed on the port and the VMPS is in secure mode, the VMPS sends a
–
port-shutdown response.
If the VLAN in the database does not match the current VLAN on the port and active hosts exist on
the port, the VMPS sends an access-denied or a port-shutdown response, depending on the secure
mode of the VMPS.
Chapter 13 Configuring VLANs
78-11380-04