15-26
Catalyst 3750-X and 3560-X Switch Software Configuration Guide
OL-21521-01
Chapter 15 Configuring VLANs
Configuring VMPS
These sections contain this information:
• “Understanding VMPS” section on page 15-26
• “Default VMPS Client Configuration” section on page 15-27
• “VMPS Configuration Guidelines” section on page 15-27
• “Configuring the VMPS Client” section on page 15-28
• “Monitoring the VMPS” section on page 15-30
• “Troubleshooting Dynamic-Access Port VLAN Membership” section on page 15-31
• “VMPS Configuration Example” section on page 15-31
Understanding VMPS
Each time the client switch receives the MAC address of a new host, it sends a VQP query to the VMPS.
When the VMPS receives this query, it searches its database for a MAC-address-to-VLAN mapping. The
server response is based on this mapping and whether or not the server is in open or secure mode. In
secure mode, the server shuts down the port when an illegal host is detected. In open mode, the server
simply denies the host access to the port.
If the port is currently unassigned (that is, it does not yet have a VLAN assignment), the VMPS provides
one of these responses:
• If the host is allowed on the port, the VMPS sends the client a vlan-assignment response containing
the assigned VLAN name and allowing access to the host.
• If the host is not allowed on the port and the VMPS is in open mode, the VMPS sends an
access-denied response.
• If the VLAN is not allowed on the port and the VMPS is in secure mode, the VMPS sends a
port-shutdown response.
If the port already has a VLAN assignment, the VMPS provides one of these responses:
• If the VLAN in the database matches the current VLAN on the port, the VMPS sends an success
response, allowing access to the host.
• If the VLAN in the database does not match the current VLAN on the port and active hosts exist on
the port, the VMPS sends an access-denied or a port-shutdown response, depending on the secure
mode of the VMPS.
If the switch receives an access-denied response from the VMPS, it continues to block traffic to and from
the host MAC address. The switch continues to monitor the packets directed to the port and sends a query
to the VMPS when it identifies a new host address. If the switch receives a port-shutdown response from
the VMPS, it disables the port. The port must be manually re-enabled by using Network Assistant, the
CLI, or SNMP.

Dynamic-Access Port VLAN Membership

A dynamic-access port can belong to only one VLAN with an ID from 1 to 4094. When the link comes
up, the switch does not forward traffic to or from this port until the VMPS provides the VLAN
assignment. The VMPS receives the source MAC address from the first packet of a new host connected
to the dynamic-access port and attempts to match the MAC address to a VLAN in the VMPS database.