Mitel MiVOICE BUSINESS, Engineering Manualline

Page: 273 / 381

Network Configuration Specifics
259
• A port that enters the “shutdown” state blocks all access. This includes a connected IP
phone, if the attaching PC is not accepted.
• The VTP management domain of the VMPS client and the VMPS server must be the same.
• When a link is active and validated it may remain open for some time. This can be changed
through the
vmps reconfirm interval command. This defaults to 60 minutes, but may need
to be reduced for tighter security. A network port setting, confirmed for a PC behind an IP
phone, will remain in effect for this interval, even if the PC is disconnected. To clear the port
settings, the IP phone must reset the link status, i.e. be reset or temporarily disconnected.
VMPS AND NETWORK SWITCH SOFTWARE REVISIONS
Only certain Cisco network switches can be used as VMPS servers. Typically, these are the
higher end core switches such as the Cisco 4000 and Cisco 6000 series. A number of other
network switches can be used as VMPS clients. VMPS Server software is also available for
Windows and Linux server platforms.
A number of Cisco network switches will support VMPS and also Auxiliary_VLAN (or voice
VLAN) for the IP phone. However, it has been found with some access switches that these two
functions may not be available at the same time, so either but not both functions can be provided.
It is recommended to check the Cisco web site to determine if the required network equipment
will support the required VMPS operations and also the minimum software version and revision
needed.
USE OF VMPS WITH 3300 ICP
The MiVoice IP Phones can determine the additional VLAN information required to direct them
to a voice VLAN through use of the Auxiliary_VLAN method. This means that the Native_VLAN
setting is available for use via VMPS. In effect, the two settings run in parallel.
Since there are now two methods, or paths, to gain access through the network port, both an
IP phone and a PC can be attached to the same network port. The PC will use the Native_VLAN
configuration through VMPS, and the IP phone will use the Auxiliary_VLAN configuration. The
auxiliary VLAN is also known as the voice VLAN on certain network switches. This method also
reduces the level of broadcast traffic that might be present on a port configured as a trunk.
VMPS allows the following settings and actions to be carried out at a Layer 2 switch port:
• It can dynamically adjust the Native_VLAN setting of the port.
• It can allow or deny access to a device based on MAC address.
• It can allow access to unrecognized devices, but to a restricted VLAN, e.g. guest, and apply
router restrictions between VLANs.
• It can shut a port down, and manual intervention is required to bring the port back.
• It can specifically deny access to certain recognized devices, e.g. most unknown devices
might go to a guest VLAN, but certain rogue devices will be specifically blocked. In this
mode, the port may be set to simply deny access, or to shut the port down.