6-2: VLAN Port Assignments
VLANs are assigned to individual switch ports.
Ports can be statically assigned to a single VLAN or dynamically assigned to a single VLAN.
All ports are assigned to VLAN 1 by default
Ports are active only if they are assigned to VLANs that exist on the switch.
Static port assignments are performed by the administrator and do not change unless modified by the administrator, whether the VLAN exists on the switch or not.
Dynamic VLANs are assigned to a port based on the MAC address of the device plugged into a port.
Dynamic VLAN configuration requires a VLAN Membership Policy Server (VMPS) client, server, and database to operate properly.
Configuring Static VLANs
On a Cisco switch, ports are assigned to a single VLAN. These ports are referred to as access ports and provide a connection for end users or node devices, such as a router or server. By default all devices are assigned to VLAN 1, known as the default VLAN. After creating a VLAN, you can manually assign a port to that VLAN and it will be able to communicate only with or through other devices in the VLAN. Configure the switch port for membership in a given VLAN as follows:
Statically assign a VLAN:
COS
set vlan number mod/port
IOS
(global) interface type mod/port
(interface) switchport access vlan number
To change the VLAN for a COS device, use the set vlan command, followed by the VLAN number, and then the port or ports that should be added to that VLAN. VLAN assignments such as this are considered static because they do not change unless the administrator changes the VLAN configuration.
For the IOS device, you must first select the port (or port range for integrated IOS) and then use the switchport access vlan command followed by the VLAN number.
CAUTION
If the VLAN that the port is assigned to does not exist in the database, the port is disabled until the VLAN is created.
Configuring Dynamic VLANs
Although static VLANs are the most common form of port VLAN assignments, it is possible to have the switch dynamically choose a VLAN based on the MAC address of the device connected to a port. To achieve this, you must have a VTP database file, a VTP server, a VTP client switch, and a dynamic port. After you have properly configured these components, a dynamic port can choose the VLAN based on whichever device is connected to that port. Use the following steps to configure dynamic VLANs:
Create a VTP database file.
Using a text editor, such as WordPad or vi, create a VTP database file and place it on a VMPS or Remote Copy Protocol (RCP) server. The VTP database file contains the following elements:
A header that includes a VMPS domain name
The VMPS operational mode
The fallback VLAN name
A list of MAC address mapped to VLAN names
The basic outline of a VMPS database file is as follows:
vmps domain Switchblock1 vmps mode open vmps fallback default vmps no-domain-req deny ! vmps-mac-addrs ! ! address 0001.0387.0943 vlan-name GroupA address 0050.0491.F950 vlan-name GroupB address 0050.DA8F.1134 vlan-name GroupC
The very first thing that should be in the VTP database file are the letters vmps followed by the word domain and a domain name. The domain name matches that of the VTP domain name of the switch(es) sending the VMPS request. (VTP is discussed further in section "6-4: VLAN Trunking Protocol.") This name is used in the request for VMPS mapping information. The next three lines in the file are information about how VMPS should operate. The mode open indicates whether a request comes in that is not in the MAC address list. The switch should place that device in a default VLAN. The next line specifies that VLAN by name. The name default is that of VLAN 1. You can also configure the mode as closed; if this is the case, the port will be suspended if the device is not in the MAC address table. The no-domain-req deny option states that any device that sends a request with no domain name should not be given any port VLAN mapping information. Each ! (exclamation point) is a comment and is ignored by the VMPS server.
The vmps-mac-addrs entry indicates the start of the MAC address to VLAN mapping. The entries are entered with the format address address vlan-name vlan_name, where the address is in dotted-hexadecimal format and the VLAN name is the exact name (including case) as found in the VLAN database of the requesting switch. When a request is sent, this mapping is returned to the requesting switch. The VLAN assignment is based on the name returned. If the name is not found on the local switch, the assignment is not made.
Configure the VMPS server.
(Optional) Set the VMPS download method:
COS
set vmps downloadmethod {rcp | tftp}
IOS
N/A
Specify how to download the VMPS database file using rcp or tftp. If you do not choose a method, the default is tftp.
Set the VMPS download server and filename:
COS
set vmps downloadserver ipaddress [filename]
IOS
N/A
Configure the IP address of the RCP or TFTP server and specify the filename of the VMPS database.
Enable the VMPS server service:
COS
set vmps state enable
IOS
N/A
When you enable the VMPS server service, it will read the file from the server into the memory of the switch and will then be able to respond to request from the VMPS client switches. Use the commands show vmps, show vmps mac, show vmps vlan, and show vmps statistics to verify the operation of the VMPS server.
NOTE
After the VMPS server service has been enabled and the VMPS information loaded into the memory of the server, the VMPS database file is no longer referenced. If you make changes to the VMPS database file, you must either disable and reenable the server service or reload the file with the command download vmps.
Configure the VMPS client:
COS
set vmps server ipaddress [primary]
IOS
(global) vmps server ipaddress primary
Any switch that will have dynamic ports is considered a VMPS client. For this switch to request the dynamic VLAN information from the server, you must configure the client with the server address. Use the primary option to specify the IP address of the main VMPS server. You can also specify up to three other IP addresses for VMPS servers. Use the command show vmps server for COS and show vmps on IOS devices to confirm the server configuration.
NOTE
If the a switch is configured as a VMPS server and it will also have dynamic ports, it must also be configured as a client using Step 3 and pointing to its own IP address as server.
Configure the port for dynamic VLAN assignments:
COS
set port membership mod/port dynamic
IOS
(interface) switchport access dynamic
This places the port in dynamic VLAN mode. The switch must first be configured as a client (Step 3) before you configure a port as dynamic. After this has been configured, the port is assigned to the local switch's VLAN that has a name that matches the one mapped to the MAC address of the attached device in the VMPS database.
Verifying VLAN Assignments
After configuring a port for VLAN assignments, use one of the following commands to verify the VLAN port assignments:
|
COS |
show port |
|
IOS |
(privileged) show interface type mod/port switchport -OR- (privileged)show interface status |
NOTE
The command show interface status is not available on all switches that run IOS.
Feature Example
In this example, ports for the switches Access_1 and Distribution_1 are assigned as follows:
Static assignments for ports 1 and 2 on the access switch and 3/1–48 on the distribution switch into VLAN 5
Static assignments for ports 3 and 4 on the access switch and 4/1–48 on the distribution switch into VLAN 8
Static assignments for ports 5 and 6 on the access switch and 5/1–12 and 5/18–24 on the distribution switch into VLAN 10
Distribution_1 will be assigned the IP address 10.1.1.1 and will serve as a VMPS server and get a file called vmpsconfig.txt (shown at the end of the example) from the server 10.1.1.101.
Ports 13–16 will be dynamic on the access switch, and ports 5/13-17 will be dynamic on the Distribution_1 server. Figure 6-1 shows the connections and assignments associated with this example.
)
Figure 6-1 VLAN Port Assignments on Access_1 and Distribution_1
An example of the Catalyst OS configuration for Distribution_1 follows:
Distribution_1 (enable)>set vlan 5 3/1-48 Distribution_1 (enable)>set vlan 8 4/1-48 Distribution_1 (enable)>set vlan 10 5/1-12,5/18-24 Distribution_1 (enable)>set vmps downloadserver 10.1.1.101 vmpsconfig.txt Distribution_1 (enable)>set int sc0 10.1.1.1/24 Distribution_1 (enable)>set vmps enable Distribution_1 (enable)>set vmps server 10.1.1.1 Distribution_1 (enable)> set port membership 5/13-17 dynamic
An example of the Supervisor IOS configuration for Distribution_1 follows:
Distribution_1(config)#interface range fastethernet 3/1 - 48 Distribution_1(config-if)#switchport Distribution_1(config-if)#switchport mode access Distribution_1(config-if)#switchport access vlan 5 Distribution_1(config-if)#no shut Distribution_1(config)#interface range fastethernet 2/1 - 48 Distribution_1(config-if)#switchport Distribution_1(config-if)#switchport mode access Distribution_1(config-if)#switchport access vlan 8 Distribution_1(config-if)#no shut Distribution_1(config)#interface range fastethernet 5/1 - 12 , 5/18 - 24 Distribution_1(config-if)#switchport Distribution_1(config-if)#switchport mode access Distribution_1(config-if)#switchport access vlan 10 Distribution_1(config-if)#no shut Distribution_1(config-if)# end Distribution_1 #copy running-config startup-config
NOTE
For the Supervisor IOS running on a Catalyst 6000 or Catalyst 4000, dynamic VLAN services are currently not supported. These switches cannot be configured with dynamic access ports or to act as a VMPS server.
An example of the Layer 2 IOS configuration for Access_1 follows:
Access_1(config)#interface fastethernet 0/1 Access_1(config-if)#switchport access vlan 5 Access_1(config-if)#interface fastethernet 0/2 Access_1(config-if)#switchport access vlan 5 Access_1(config-if)#interface fastethernet 0/3 Access_1(config-if)#switchport access vlan 8 Access_1(config-if)#interface fastethernet 0/4 Access_1(config-if)#switchport access vlan 8 Access_1(config-if)#interface VLAN 1 Access_1(config-if)#ip address 10.1.1.2 255.255.255.0 Access_1(config-if)#vmps server 10.1.1.1 Access_1(config)#interface fastethernet 0/5 Access_1(config-if)#switchport access dynamic Access_1(config-if)#interface fastethernet 0/6 Access_1(config-if)#switchport access vlan dynamic Access_1(config-if)# end Access_1 #copy running-config startup-config
An example of the VMPS database file vmpsconfig.txt follows:
vmps domain Switchblock1 vmps mode open vmps fallback default vmps no-domain-req allow ! vmps-mac-addrs ! ! address 0001.0387.0943 vlan-name Katie address 0050.0491.F950 vlan-name Logan address 0050.DA8F.1134 vlan-name Cameron