Vlan vmpsd

brentnissen
brentnissen used Ask the Experts™
on
Well, a little scared about an old set up we have:

We use VMPS on our cisco switches.
Fedor 4 running the vmpsd service

Anyone have advice in this area for quickly changing the cisco vlan ports if the fedora were to crash so as default dhcp could be used,  and, other ideas for using vlan in a domain area as cheap and easy as was using the fedora
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Jody LemoineNetwork Architect

Commented:
Unfortunately, with VMPS, the VLAN assignment comes is entirely handled by the server.  The client really doesn't have an option to set a default VLAN to be used in the event that vmpsd becomes unavailable.  The switch *does* have the option of doing lookups on a secondary server should the primary one fail.

In the short term, I would consider setting up a second instance of vmpsd on another server, synchronizing the VMPS configuration between the two and configuring your switches to use one as the primary and the other as a secondary.  In the long term, I would look to more modern technologies such as 802.1x for better security and increased flexibility.  The initial implementation is more complex than with VMPS, but the long-term administration is simpler...  and it can be done with free/inexpensive software.
Jody LemoineNetwork Architect

Commented:
Please ignore "comes" in that first line.   It was just an editing leftover.

The global configuration mode commands for defining primary and secondary servers are as follows:

vmps server x.x.x.x primary
vmps server x.x.x.y

Author

Commented:
yep. that's exactly as it is now.

what type of implementation using 802.1 are you suggesting (even though I know a quick google would show) or use or like...and the worse question along with this; complex??? I hate complex!!! :-)
Should you be charging more for IT Services?

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Jody LemoineNetwork Architect

Commented:
802.1x is a more current way of doing things.  It involves user-based authentication rather than MAC-based authentication.  Everything is done via a RADIUS server and user authentication.  It's a bit complex to set up, given that there are encryption considerations, but everything can be managed more easily once it's done.

A very nice presentation about Cisco IBNS (802.1x) can be found here: http://www.cisco.com/en/US/solutions/collateral/ns340/ns394/ns171/CiscoIBNS-Technical-Review.pdf

If you aren't all that concerned about security implications, want to stick with simple and are looking for a dynamic protocol for automatic VLAN assignment, VMPS on two or more servers should provide this with sufficient resilience.  You're not going to be able to dictate a default VLAN with VMPS like you can with 802.1x, but if the servers and switches are configured correctly, you shouldn't need to worry about that.

Author

Commented:
I already have two, actually three vmpsd setups for use and redundancy. My intial question and concern though was if neccessary how to quickly change the info on the cisco ports with out having to do a "switchport" on each one setup for "dynamic"...if there was a command to do multiple ports the same time...of course this means removing vmpsd from it also. I am asking this just in case the other vmpsd servers did not respond or work.
Network Architect
Commented:
Oh, well if you just want to do it manually, that's a different thing entirely and it can be done fairly quickly.

interface range fastEthernet 0/1 - 48
 switchport access vlan x

Replace x with whatever VLAN you want the port to be a member of.  Switching it back to VMPS functionality is also easy.

interface range fastEthernet 0/1 - 48
 switchport access vlan dynamic

This assumes you're using a 48-port switch.  Adjust the numbers accordingly.

The VMPS client configuration can remain on the switch.  It just won't apply to any interface that doesn't have the "switchport access vlan dynamic" entry.

Author

Commented:
we are gigabit but that confirms doing "multiple" ports..just wasnt sure.
Jody LemoineNetwork Architect

Commented:
The same syntax will work with gigabit, just substitute GigabitEthernet for FastEthernet.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial