|Switching: Dynamic VLAN's, VQP, and VMPS|
|Sunday, 10 October 1999 21:00|
IntroductionThis article continues the series on LAN switching and Cisco Catalyst switches. This month we'll talk about dynamic VLAN's, and explain what VQP and VMPS are, as well as how they work and how to configure them.
Prior articles in the series:
What are VQP and VMPSWe talked in a prior article about configuring ports to belong to a VLAN. This is the static approach to VLAN's, where a port is always a member of a specific VLAN. You can also configure a port to dynamically determine what VLAN to belong to. Initially (and fundamentally) this process is tied to the MAC address of the end station on the port. Cisco is in the process of making this much more administrator-friendly (and useful!) by tying it into directory servers -- more on that later.
There is a process whereby a switch with a dynamic port can query a server with end station information to find out what VLAN the port should be in. The query is done via VQP, VLAN Query Protocol. The query goes to a VMPS, VLAN Membership Policy Server. The VMPS was initially a Catalyst 5xxx, but this is in the process of changing to where the server is perhaps a workstation running URT, User Response Tool, and eventually to perhaps a Windows 2000 Active Directory Server.
The following are capable of being VMPS servers right now: supervisor software release 2.3 or later on Catalyst 5000 and 2926G series switches. Many of the Cisco switches are capable of being VQP-using clients with dynamic VLAN's.
You can have several end stations on a dynamic port (using a hub), but they must all belong to the same dynamic VLAN. If there are more than 20 (29xx XL) to 50 (Catalyst 5xxx) end stations on a single port, the dynamic port will be shut down by the switch.
Configuring VMPSConfiguring VMPS is fairly simple, with only one minor surprise. (Troubleshooting it, however, may be a bit more complex).
Catalyst Set-Based ConfigurationReferences:
set vmps tftpserver ip-address [filename]This tells the future VMPS server what TFTP server to get information from, and optionally what filename the information will be under. The default filename is vmps-config-database.1.
You then do a
set vmps state enable(the alternative being disable), upon which the wannabe VMPS server will attempt to download the configuration database specified with the tftpserver command. If the TFTP download succeeds, then VMPS will become enabled. If the transfer fails, you'll get an error message and VMPS will remain disabled. The download/enable process also takes place when you reboot the switch.
You can force a download of new VMPS server information to a server with the command
download vmpsThis also can be used to retry after a download fails.
To set up a set-based switch as a VQP client, you need to tell it who its VMPS server is. This is done with the command
set vmps server server-ip-address [primary]You can do this up to three times, one primary and two backup VMPS servers. When the primary is down, it's status will be checked every five (5) minutes. When it is back up, queries will again be sent to the primary first.
For there to be any point to having a client, you need to use dynamic VLAN's. A port is made dynamic with the command
set port membership mod_num/port_num dynamicand the status will show up in the show port command output. Use the command
reconfirm vmpsoccasionally as enabled (privileged) user, if you wish to have the switch reconfirm all dynamic port VLAN assignments.
The design intent appears to be for there to be a VMPS server for local switches, say switches sharing a VTP domain. The point here is: you probably do not want to have to reach your VMPS server through a router, and if you do, it is the one Layer 3 switching hop to the server farm on a campus (more on this if I write a switched campus design article).
Other related commands:
Ways that VMPS can fail to start up:
Ways VMPS/VQP and dynamic VLAN's can fail:
IOS-Based Configuration (2900 XL Series)References:
To specify VMPS server, use the configuration command
show vmpsTo make an interface (port) dynamic instead of static, configure
interface fastethernet 0/1You can check this with
show interface interface switchportTo have the switch re-check the dynamic port VLAN assignments, use the EXEC mode command
vmps reconfirmThe default reconfirm interval is 60 minutes. The default number of retries on a VQP query are 3. You can configure these with
vmps reconfirm minutes
VMPS Configuration DatabaseHere is a sample of the VMPS configuration database file that a VMPS server might download from a TFTP server. Note that the syntax is not well documented. The file must start with the VMPS domain name, which must match the VTP domain (including case). Do NOT capitalize "vmps", the file contents are case-sensitive (and in at least some of the Cisco documentation I've seen, the Marketing Communications rewrite capitalized "vmps" as the name of the protocol/acronym).
The second line of the sample below specifies security mode, which can be either open or secure. In secure mode, an unknown MAC address causes the port to be shut down. In open mode, unknown MAC addresses are assigned to fallback (default) "unsecure" VLAN, specified with the vmps fallback line. The default mode is open. You can also specify whether requests with no VTP/VMPS domain are allowed or denied. By the way, when unknown MAC addresses or denied situations occur, the switch can send a SNMP trap to your SNMP trap receiver (management station). This might be useful for tracking use of unauthorized PC's in a campus environment (provided that's something you care to manage).
vmps domain mydomainThis section of the configuration database file is followed by the list of MAC addresses and VLAN names:
vmps-mac-addrsNote that "--NONE--" is a way of excluding an untrusted MAC address: the VMPS server will send a denied response to any queries.
You can apparently specify what devices are allowed on what ports (I haven't tried this). Note that quotes are used when the name contains a space.
! vmps-port-group <group-name>You can then create groups of VLAN (names) and then policies as to which VLAN's are allowed on which ports (using the above port-groups):
! vmps-vlan-group <group-name>
CiscoWorks 2000 and VMPSThe User Tracking tool allows CW2000 to learn which users are on which ports in which VLAN's. This can be handy for troubleshooting, since not just MAC addresses but IP addresses can be picked up by the software (from ARP caches).
You can use the tool to then change multiple switch ports to dynamic status. You can also use it to save the MAC address information to TFTP server, and you can even trigger the VMPS server to download fresh MAC address table information.
Oh, and you can use CiscoView (and SNMP) to configure the VMPS servers and clients. We do a demo of all this in the CEMS CiscoWorks 2000 course.
Wrap-UpThe question all of this leaves me with is, "how do you troubleshoot it when it breaks". That is, dynamic VLAN's are nifty. Having multiple VMPS servers means you probably won't have an entire campus down at one time. Nonetheless, VQP adds one more thing that can go wrong. Troubleshooting it has so far not been bad for me, but you do have to be careful with typos and do have to make sure you have a good scheme for managing and communicating with your switches (probably on VLAN 1).
I'm planning more switching topics for the next month or two. We may also sneak in a little design: you need to think about end-to-end VLAN's versus the "Layer 2 / Layer 3" hierarchical approach. See you in a month!
Copyright (C) 1999, Peter J. Welcher