Cisco WS-C2980G-A Software Guide - Page 254

VMPS and Dynamic Port Hardware and Software Requirements Chapter 12 Configuring Dynamic VLAN Membership with VMPS If the assigned VLAN is restricted to a group of ports, VMPS verifies the requesting port against this group. If the VLAN is allowed on the port, the VLAN name is returned to the client. If the VLAN is not allowed on the port and VMPS is in open mode, the host receives an "access denied" response. If VMPS is in secure mode, the port is shut down and you must manually bring the port back up with the set port command. If a VLAN in the database does not match the current VLAN on the port and active hosts are on the port, VMPS sends an access denied or a port shutdown response based on the VMPS secure mode. You can configure a fallback VLAN name. If you connect a device with a MAC address that is not in the database, VMPS sends the fallback VLAN name to the client. If you do not configure a fallback VLAN and the MAC address does not exist in the database, VMPS sends an access denied response when VMPS is in open mode. If VMPS is in secure mode, it sends a port shutdown response. You can also make an explicit entry in the configuration table to deny access to specific MAC addresses for security reasons by specifying the --NONE-- keyword for the VLAN name. In this case, VMPS sends an access denied or port shutdown response. A dynamic port can belong to only one native VLAN in software releases prior to software release 6.2(1). With software release 6.2(1), a port can belong to a native VLAN and an auxiliary VLAN. See the "Dynamic Port VLAN Membership with Auxiliary VLANs" section on page 12-14 for complete details. When the link comes up, a dynamic port is isolated from its static VLAN. The source MAC address from the first packet of a new host on the dynamic port is sent to the VMPS server, which attempts to match the MAC address to a VLAN in the VMPS database. If there is a match, VMPS provides the VLAN number to assign to the port. If there is no match, VMPS either denies the request or shuts down the port (depending on the VMPS secure mode setting). You can use up to 50 hosts (MAC addresses) on a dynamic port if they are all authorized for the same VLAN. Each host that comes online through the port is checked against the VMPS database before the host is assigned to a VLAN. If you move a host from one dynamic port to another, the port remains assigned to the VLAN until another MAC address changes the VLAN. You do not need to do clean up. All clean up is completed by the VMPS database. VMPS and Dynamic Port Hardware and Software Requirements VMPS and dynamic port membership requires these software and hardware versions (later software versions might be required depending on the specific hardware): • Software release 5.1 or later releases-The Catalyst 4000 series switches support only VMPS clients. • Software release 7.2 or later releases-The Catalyst 4000 series and Catalyst 4500 series switches support both VMPS servers and clients. • VMPS-capable hardware-To determine whether a specific piece of hardware supports dynamic port VLAN membership, refer to your hardware documentation or use the show port capabilities command. Dynamic port membership is not supported on Gigabit Ethernet ports. 12-2 Catalyst 4500 Series, Catalyst 2948G, Catalyst 2980G Switches Software Configuration Guide-Release 8.1 78-15486-01