Configuring Dynamic VLAN Membership

These sections describe how to configure dynamic VLANs:

In response to a request, the VMPS takes one of the following actions:

• If the assigned VLAN is restricted to a group of ports, the VMPS verifies the requesting port against this group and responds as follows:

  • If the VLAN is allowed on the port, the VMPS sends the VLAN name to the client in response.

  • If the VLAN is not allowed on the port, and the VMPS is not in secure mode, the VMPS sends an access-denied response.

  • If the VLAN is not allowed on the port, and the VMPS is in secure mode, the VMPS sends a port-shutdown response.

• If the VLAN in the database does not match the current VLAN on the port and there are active hosts on the port, the VMPS sends an access-denied or a port-shutdown response, depending on the secure mode of the VMPS.

If the switch receives an access-denied response from the VMPS, it continues to block traffic from the MAC address to or from the port. The switch continues to monitor the packets directed to the port and sends a query to the VMPS when it identifies a new address. If the switch receives a port-shutdown response from the VMPS, it disables the port. The port must be manually reenabled by using the CLI, Cisco Visual Switch Manager (CVSM), or SNMP.

You can also use an explicit entry in the configuration table to deny access to specific MAC addresses for security reasons. If you enter the --NONE-- keyword for the VLAN name, the VMPS sends an access-denied or port-shutdown response.

You must turn off trunking on the port before the dynamic access setting takes effect.

• Dynamic ports cannot be network ports or monitor ports.

If you are configuring a member switch in a cluster, this parameter must be equal to or greater than the reconfirmation setting on the command switch. In addition, you must first log in to the member switch by using the privileged EXEC rcommand command. See the Cisco IOS Desktop Switching Command Reference for more information on how to use this command.

Perform this task from privileged EXEC mode:

This example shows how to change the reconfirmation interval to 60 minutes and verify the change by displaying the VMPS information:

Switch# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(config)# vmps reconfirm 60 Switch(config)# end Switch# show vmps VQP Client Status: -------------------- VMPS VQP Version: 1

Reconfirm Interval: 60 min Server Retry Count: 10 VMPS domain server: 172.20.130.50 (primary, current) Reconfirmation status --------------------- VMPS Action: No Host

This example shows how to reconfirm dynamic port VLAN membership assignments from privileged EXEC mode:

To reenable a shut-down dynamic port, enter the interface configuration mode
no shutdown command.

In this procedure, the Catalyst 5000 switches are the VMPS servers. Use this procedure to configure the Catalyst 3500 series XL and Catalyst 2900 series XL clients in the network:

Step 1 Configure the VMPS server addresses on Switch 2, the client switch.

(a) Starting from privileged EXEC mode, enter global configuration mode:

switch# configuration terminal

(a) Enter the primary VMPS server IP address:

switch(config)# vmps server 172.20.26.150 primary

(b) Enter the secondary VMPS server IP addresses:

switch(config)# vmps server 172.20.26.152

(c) To verify your entry of the VMPS IP addresses, return to privileged EXEC mode:

switch#(config) exit

(d) Display VMPS information configured for the switch:

switch# show vmps VQP Client Status: -------------------- VMPS VQP Version: 1 Reconfirm Interval: 60 min Server Retry Count: 3 VMPS domain server: 172.20.26.152 172.20.26.150 (primary, current

Step 2 Configure port Fa0/1 on Switch 2 as a dynamic port.

(a) Return to global configuration mode:

switch# configure terminal

(b) Enter interface configuration mode:

switch(config)# interface fa0/1

(c) Configure the VLAN membership mode for static-access ports:

switch(config-if)# switchport mode access

(d) Assign the port dynamic VLAN membership:

switch(config-if)# switchport access vlan dynamic

(e) Return to privileged EXEC mode:

switch(config-if)# exit switch#

Step 3 Connect End Station 2 on port Fa0/1. When End Station 2 sends a packet,
Switch 2 sends a query to the primary VMPS server, Switch 1. Switch 1 responds with the VLAN ID for port Fa0/1. Because Spanning-Tree Protocol Port Fast mode is enabled by default on dynamic ports, port Fa0/1 connects immediately and begins forwarding.

Step 4 Set the VMPS reconfirmation period to 60 minutes. The reconfirmation period is the number of minutes the switch waits before reconfirming the VLAN to MAC address assignments.

switch# config terminal switch(config)# vmps reconfirm 60

Step 5 Confirm the entry from privileged EXEC mode:

switch# show vmps VQP Client Status: -------------------- VMPS VQP Version: 1 Reconfirm Interval: 60 min Server Retry Count: 3 VMPS domain server: Reconfirmation status --------------------- VMPS Action: No Dynamic Port

Step 6 Repeat Steps 1 and 2 to configure the VMPS server addresses and assign dynamic ports on each VMPS client switch.