10-19
Software Configuration Guide—Release 12.2(25)SG
OL-7659-03
Chapter10 Understanding and Conf iguring VLANs, VTP, and VMPS
VLAN Membership Policy Server
If a VLAN is already assigned to this port, VMPS verifies the requesting MAC address against this port:
•If the VLAN associated with this MAC address in the database does not match the current VLAN
assigned on the port, and a fallback VLAN name is configured, VMPS sends the fallback VLAN
name to the client.
•If a VLAN associated with this MAC address in the database does not match the current VLAN
assigned on the port, and a fallback VLAN name is not configured, the host receives an “access
denied” response.

Secure Mode

If no VLAN is assigned to this port, VMPS verifies the requesting MAC address against this port:
•If the VLAN associated with this MAC address is allowed on the port, the VLAN name is returned
to the client.
•If the VLAN associated with this MAC address is not allowed on the port, the port is shut down.
If a VLAN is already assigned to this port, VMPS verifies the requesting MAC address against this port:
•If a VLAN associated with this MAC address in the database does not match the current VLAN
assigned on the port, the port is shutdown, even if a fallback VLAN name is configured.

Multiple Mode

Multiple hosts (MAC addresses) can be active on a dynamic port if they are all in the same VLAN. If the
link fails on a dynamic port, the port returns to the unassigned state. Any hosts that come online through
the port are checked again with VMPS before the port is assigned to a VLAN.
If multiple hosts connected to a dynamic port belong to different VLANs, the VLAN matching the MAC
address in the last request is returned to the client provided that multiple mode is configured on the
VMPS server.
Note Although Catalyst 4500 series and Catalyst 6500 series switche s running Catalyst operating system
software support VMPS in all three operation modes, the User Registration Tool (URT) supports open
mode only.
Fallback VLAN
You can configure a fallback VLAN name on a VMPS server.
If no VLAN has been assigned to this port, VMPS compares the requesting MAC address to this port:
•If you connect a device with a MAC address that is not in the database, the VMPS sends the fallback
VLAN name to the client.
•If you do not configure a fallback VLAN name and the MAC address does not exist in the database,
the VMPS sends an “access-denied” response.
If a VLAN is already assigned to this po rt, VMPS compares the requesting MAC address to this port:
•If the VMPS is in secure mode, it sends a “port-shutdown” response, whether or not a fallback
VLAN has been configured on the server.