Cisco IE 4000, Software Configuration Manual

Page: 286 / 1066

282
Configuring VLANs
VLANs
Figure 31 Load-Sharing Trunks with Traffic Distributed by Path Cost
See Configuring Load Sharing Using STP Path Cost, page 288 .
VMPS
The VLAN Query Protocol (VQP) is used to support dynamic-access ports, which are not permanently assigned to a
VLAN, but give VLAN assignments based on the MAC source addresses seen on the port. Each time an unknown MAC
address is seen, the switch sends a VQP query to a remote VMPS; the query includes the newly seen MAC address and
the port on which it was seen. The VMPS responds with a VLAN assignment for the port. The switch cannot be a VMPS
server but can act as a client to the VMPS and communicate with it through VQP.
Each time the client switch receives the MAC address of a new host, it sends a VQP query to the VMPS. When the VMPS
receives this query, it searches its database for a MAC-address-to-VLAN mapping. The server response is based on this
mapping and whether or not the server is in open or secure mode. In secure mode, the server shuts down the port when
an illegal host is detected. In open mode, the server simply denies the host access to the port.
If the port is currently unassigned (that is, it does not yet have a VLAN assignment), the VMPS provides one of these
responses:

If the host is allowed on the port, the VMPS sends the client a vlan-assignment response containing the assigned
VLAN name and allowing access to the host.

If the host is not allowed on the port and the VMPS is in open mode, the VMPS sends an access-denied response.

If the VLAN is not allowed on the port and the VMPS is in secure mode, the VMPS sends a port-shutdown response.
If the port already has a VLAN assignment, the VMPS provides one of these responses:

If the VLAN in the database matches the current VLAN on the port, the VMPS sends a success response, allowing
access to the host.

If the VLAN in the database does not match the current VLAN on the port and active hosts exist on the port, the
VMPS sends an
access-denied or a port-shutdown response, depending on the secure mode of the VMPS.
If the switch receives an access-denied response from the VMPS, it continues to block traffic to and from the host MAC
address. The switch continues to monitor the packets directed to the port and sends a query to the VMPS when it
identifies a new host address. If the switch receives a
port-shutdown response from the VMPS, it disables the port. The
port must be manually reenabled by using Network Assistant, the CLI or SNMP.
Dynamic-Access Port VLAN Membership
A dynamic-access port can belong to only one VLAN with an ID from 1 to 4096. When the link comes up, the switch
does not forward traffic to or from this port until the VMPS provides the VLAN assignment. The VMPS receives the source
MAC address from the first packet of a new host connected to the dynamic-access port and attempts to match the MAC
address to a VLAN in the VMPS database.
90573
Switch A
Switch B
Trunk port 1
VLANs 2 – 4 (path cost 30)
VLANs 8 – 10 (path cost 19)
Trunk port 2
VLANs 8
– 10 (path cost 30)
VLANs 2 – 4 (path cost 19)