VLAN Management Policy Server

Usually, when we have to do network segmentation using VLANs, we create the necessary networks either manually or automatically using protocols like Cisco VTP (VLAN Trunking Protocol). After that, we assign each one of the network devices to the different VLANs defined. This means that if I move tomorrow and change my laptop of network connection point, I will have to change the new network connection point so it belongs to the original VLAN I had.

One solution to this problem is the use of the VTP protocol together with the Cisco VMPS (VLAN Management Policy Server) service, which provides a first approximation to a solution of network access control such as the ones offered by manufacturers today. Among other features, VMPS allows to dynamically associate devices to VLANs based on MAC address (with the security issues this involves). This way, I can connect my laptop to any network point of the office and it will always belong to the same correct VLAN.

Any midrange Cisco switch supports VMPS as client. However, only the upper range (higher than 4000) support the server mode. Despite this, it is not necessary to have one of these devices to implement this solution because there are many tools, both free (some outdated) and commercial, that provide the VMPS server functionality we need. Among all them, we have selected vmpsd (http://sourceforge.net/projects/vmps/), a little daemon for GNU/Linux that provides a VMPS server without installing too much software, as a management system database. To configure VMPS on our switch (the Cisco 2960 is the chosen device), we have to perform the following steps:

1) Configure VTP

Switch(config)#vtp  mode  server 
Switch(config)#vtp  domain s2

Switch#show  vtp  status 
          : running VTP2
Configuration Revision          : 1
Maximum VLANs supported locally : 255
Number of existing VLANs        : 14
VTP Operating Mode              : Server
VTP Domain Name                 : s2
VTP Pruning Mode                : Disabled
VTP V2 Mode                     : Enabled
VTP Traps Generation            : Disabled
MD5 digest                      : 0xC4 0xE8 0xDB 0x1A 0xF2 0x6B 0xC2 0x79 

2) Configure the switch device as a VMPS client

To perform this configuration, we use the IP address of the main VPMS server (we can have several).

Switch(config)# vmps retry 3
Switch(config)# vmps reconfirm 1
Switch(config)# vmps server 172.18.0.150 primary
Switch#show  vmps 
VQP Client Status:
--------------------
VMPS VQP Version:   1
Reconfirm Interval: 1 min
Server Retry Count: 3
VMPS domain server: 172.18.0.150 (primary, current)
Reconfirmation status
---------------------
VMPS Action:         No Dynamic Port

3) Create the VLANs

Switch(config)#vlan 21
Switch(config-vlan)#name MANAGMT
Switch(config)#vlan 22
Switch(config-vlan)#name USUARIOS
Switch(config)#vlan 23
Switch(config-vlan)#name GUESTS
Switch#show  vlan 
VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
21   MANAGMT                          active    
22   USUARIOS                         active    
23   GUESTS                           active   

4) Mark the interfaces that use VMPS

Switch(config)#interface  range  fastEthernet 0/10-20 
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan dynamic

Switch#show  interface fastEthernet 0/10 switchport 
Name: Fa0/10
Switchport: Enabled
Administrative Mode: dynamic access  ******
Operational Mode: down
Administrative Trunking Encapsulation: dot1q
Negotiation of Trunking: Off
Access Mode VLAN: unassigned  *******
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: none
Administrative private-vlan host-association: none 
Administrative private-vlan mapping: none 
Administrative private-vlan trunk native VLAN: none
Administrative private-vlan trunk Native VLAN tagging: enabled
Administrative private-vlan trunk encapsulation: dot1q
Administrative private-vlan trunk normal VLANs: none
Administrative private-vlan trunk associations: none
Administrative private-vlan trunk mappings: none
Operational private-vlan: none
Trunking VLANs Enabled: ALL
Pruning VLANs Enabled: 2-1001
Capture Mode Disabled
Capture VLANs Allowed: ALL

5) Configure the VMPS server (vlan.db)

vmps domain s2
vmps mode open
vmps fallback GUESTS
vmps no-domain-req deny

vmps-mac-addrs
address 0023.8bd7.c2b3 vlan-name MANAGMT

In the configuration must take into account the following:

  • The domain must coincide with the one configured in VTP.
  • The “GUESTS” VLAN is used to redirect the MACs that are not authorized by the policy because we have configured the open mode. If we use the secure mode, the interface would be disabled.
  • We assign the MAC address of my laptop to the VLAN “MANAGMT”.

Once here, we start the daemon and launch a test query (we use the IP address, the VTP domain and MAC address)

perl vqpcli.pl  -s 172.18.0.150 -v s2  -m 0023.8bd7.c2b3
Vlan: MANAGMT
MAC Address: 00238bd7c2b3 
Status: ALLOW

As we can see, the MAC address is authorized and it gets the VLAN “MANAGMT”. Reached this point, we just have to connect to the switch (we set the debug mode on with the command debug vqpc all) to do several tests:

Connect the laptop to one of the network connection points defined to use VMPS (fa0/13).

*Mar  1 02:23:09.070: VQPC EVENT: -pm_port_vqp_start: port Fa0/13
*Mar  1 02:23:11.075: %LINK-3-UPDOWN: Interface FastEthernet0/13, changed state to up
*Mar  1 02:23:12.081: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/13, changed 
                      state to up
*Mar  1 02:23:13.986: VQPC LEARN: 
*Mar  1 02:23:13.986: VQPC LEARN: -learning mac 0023.8bd7.c2b3 on vlan 0, port Fa0/13
*Mar  1 02:23:13.986: VQPC LEARN: adding mac 0023.8bd7.c2b3 on vlan 0, port Fa0/13, type = 0x0021
*Mar  1 02:23:13.986: VQPC: allocating transID 0x00000471
*Mar  1 02:23:13.986: VQPC PAK: xmt transaction ID = 0x00000471
*Mar  1 02:23:13.986: VQPC PAK: sending query to VMPS
*Mar  1 02:23:13.986: VQPC PAK:  
*Mar  1 02:23:13.986: VQPC PAK: rcvd packet from VMPS
*Mar  1 02:23:13.994: VQPC PAK: transaction ID = 0x00000471
*Mar  1 02:23:13.994: VQPC: rcvd response, transID = 0x00000471
*Mar  1 02:23:13.994: VQPC PAK: VLAN name TLV, vlanName = MANAGMT
*Mar  1 02:23:13.994: VQPC PAK: Cookie TLV, cookie = 0023.8bd7.c2b3, length = 6
*Mar  1 02:23:13.994: VQPC EVENT: -set_hwidb_vlanid: port Fa0/13 to vlan 21, mac: 0023.8bd7.c2b3
*Mar  1 02:23:13.994: VQPC EVENT: saving 0023.8bd7.c2b3 from old vlan 0
*Mar  1 02:23:13.994: VQPC EVENT: changing Fa0/13 to vlan 21
*Mar  1 02:23:13.994: VQPC LEARN: adding mac 0023.8bd7.c2b3 on vlan 21, port Fa0/13, type = 0x0001
*Mar  1 02:23:13.994: VQPC LEARN: deleting mac 0023.8bd7.c2b3 on vlan 0, port Fa0/13
*Mar  1 02:23:13.994: VQPC LEARN: changing mac 0023.8bd7.c2b3 on vlan 21, port Fa0/13 to FORWARDING

As we can see, it assigns to the MAC address the VLAN 21 (“MANAGMT”):

Switch#show  vlan 

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
21   MANAGMT                          active    Fa0/13
22   USUARIOS                         active   
23   GUESTS                           active    

Switch#show  interface fastEthernet  0/13 switchport 
Name: Fa0/13
Switchport: Enabled
Administrative Mode: dynamic access
Operational Mode: dynamic access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: Off
Access Mode VLAN: 21 (MANAGMT)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: none
Administrative private-vlan host-association: none 
Administrative private-vlan mapping: none 
Administrative private-vlan trunk native VLAN: none
Administrative private-vlan trunk Native VLAN tagging: enabled
Administrative private-vlan trunk encapsulation: dot1q
Administrative private-vlan trunk normal VLANs: none
Administrative private-vlan trunk associations: none
Administrative private-vlan trunk mappings: none
Operational private-vlan: none
Trunking VLANs Enabled: ALL
Pruning VLANs Enabled: 2-1001
Capture Mode Disabled

Now we disconnect it and connect it to other switch port (fa0/17):

*Mar  1 02:24:42.938: VQPC EVENT: -pm_port_vqp_start: port Fa0/17
*Mar  1 02:24:44.650: VQPC LEARN: 
*Mar  1 02:24:44.650: VQPC LEARN: -learning mac 0023.8bd7.c2b3 on vlan 0, port Fa0/17
*Mar  1 02:24:44.650: VQPC LEARN: adding mac 0023.8bd7.c2b3 on vlan 0, port Fa0/17, type = 0x0021
*Mar  1 02:24:44.650: VQPC: allocating transID 0x00000491
*Mar  1 02:24:44.650: VQPC PAK: xmt transaction ID = 0x00000491
*Mar  1 02:24:44.650: VQPC PAK: sending query to VMPS
*Mar  1 02:24:44.650: VQPC PAK:  
*Mar  1 02:24:44.650: VQPC PAK: rcvd packet from VMPS
*Mar  1 02:24:44.650: VQPC PAK: transaction ID = 0x00000491
*Mar  1 02:24:44.650: VQPC: rcvd response, transID = 0x00000491
*Mar  1 02:24:44.650: VQPC PAK: VLAN name TLV, vlanName = MANAGMT
*Mar  1 02:24:44.650: VQPC PAK: Cookie TLV, cookie = 0023.8bd7.c2b3, length = 6
*Mar  1 02:24:44.650: VQPC EVENT: -set_hwidb_vlanid: port Fa0/17 to vlan 21, mac: 0023.8bd7.c2b3
*Mar  1 02:24:44.650: VQPC EVENT: saving 0023.8bd7.c2b3 from old vlan 0
*Mar  1 02:24:44.650: VQPC EVENT: changing Fa0/17 to vlan 21
*Mar  1 02:24:44.658: VQPC LEARN: adding mac 0023.8bd7.c2b3 on vlan 21, port Fa0/17, type = 0x0001
*Mar  1 02:24:44.658: VQPC LEARN: deleting mac 0023.8bd7.c2b3 on vlan 0, port Fa0/17
*Mar  1 02:24:44.658: VQPC LEARN: changing mac 0023.8bd7.c2b3 on vlan 21, port Fa0/17 to FORWARDING
*Mar  1 02:24:44.943: %LINK-3-UPDOWN: Interface FastEthernet0/17, changed state to up
*Mar  1 02:24:45.950: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/17, 
                      changed state to up

Switch#sh mac-address-table | inc DYNAMIC
  21    0023.8bd7.c2b3    DYNAMIC     Fa0/17

Switch#show  vlan                                    

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
21   MANAGMT                          active    Fa0/13, Fa0/17
22   USUARIOS                         active   
23   GUESTS                           active    

We see that the Fa0/13 interface is still assigned to the VLAN “MANAGMT”, so we connect other computer to that port:

*Mar  1 00:03:35.016: VQPC EVENT: -pm_port_vqp_start: port Fa0/13
*Mar  1 00:03:36.887: VQPC LEARN: 
*Mar  1 00:03:36.887: VQPC LEARN: -learning mac 0005.1b00.3f81 on vlan 0, port Fa0/13
*Mar  1 00:03:36.887: VQPC LEARN: adding mac 0005.1b00.3f81 on vlan 0, port Fa0/13, type = 0x0021
*Mar  1 00:03:36.887: VQPC: allocating transID 0x00000061
*Mar  1 00:03:36.887: VQPC PAK: xmt transaction ID = 0x00000061
*Mar  1 00:03:36.887: VQPC PAK: sending query to VMPS
*Mar  1 00:03:36.887: VQPC PAK:  
*Mar  1 00:03:36.887: VQPC PAK: rcvd packet from VMPS
*Mar  1 00:03:36.887: VQPC PAK: transaction ID = 0x00000061
*Mar  1 00:03:36.887: VQPC: rcvd response, transID = 0x00000061
*Mar  1 00:03:36.887: VQPC PAK: VLAN name TLV, vlanName = GUESTS
*Mar  1 00:03:36.887: VQPC PAK: Cookie TLV, cookie = 0005.1b00.3f81, length = 6
*Mar  1 00:03:36.887: VQPC EVENT: -set_hwidb_vlanid: port Fa0/13 to vlan 23, mac: 0005.1b00.3f81
*Mar  1 00:03:36.887: VQPC EVENT: saving 0005.1b00.3f81 from old vlan 0
*Mar  1 00:03:36.887: VQPC EVENT: changing Fa0/13 to vlan 23
*Mar  1 00:03:36.895: VQPC LEARN: adding mac 0005.1b00.3f81 on vlan 23, port Fa0/13, type = 0x0001
*Mar  1 00:03:36.895: VQPC LEARN: deleting mac 0005.1b00.3f81 on vlan 0, port Fa0/13
*Mar  1 00:03:36.895: VQPC LEARN: changing mac 0005.1b00.3f81 on vlan 23, port Fa0/13 to FORWARDING
*Mar  1 00:03:37.021: %LINK-3-UPDOWN: Interface FastEthernet0/13, changed state to up
*Mar  1 00:03:38.028: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/13, 
                      changed state to up

As the MAC address is not authorized by the defined policy, it assigns dinamically the VLAN “GUESTS”.

Switch#show  vlan 

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
21   MANAGMT                          active    Fa0/17
22   USUARIOS                         active    Fa0/24
23   GUESTS                           active    Fa0/13

If we now change the policy to the secure mode and without a fallback VLAN we connect the same PC:

*Mar  1 00:12:57.019: VQPC LEARN: 
*Mar  1 00:12:57.019: VQPC LEARN: -learning mac 0005.1b00.3f81 on vlan 0, port Fa0/13
*Mar  1 00:12:57.019: VQPC LEARN: adding mac 0005.1b00.3f81 on vlan 0, port Fa0/13, type = 0x0021
*Mar  1 00:12:57.019: VQPC: allocating transID 0x00000151
*Mar  1 00:12:57.019: VQPC PAK: xmt transaction ID = 0x00000151
*Mar  1 00:12:57.019: VQPC PAK: sending query to VMPS
*Mar  1 00:12:57.019: VQPC PAK:  
*Mar  1 00:12:57.019: VQPC PAK: rcvd packet from VMPS
*Mar  1 00:12:57.019: VQPC PAK: transaction ID = 0x00000151
*Mar  1 00:12:57.019: VQPC: rcvd response, transID = 0x00000151
*Mar  1 00:12:57.019: %VQPCLIENT-2-SHUTDOWN: Interface Fa0/13 shutdown by VMPS
*Mar  1 00:12:57.019: %PM-4-ERR_DISABLE: vmps error detected on Fa0/13, putting Fa0/13 in 
                      err-disable state
*Mar  1 00:12:57.019: VQPC EVENT: -pm_port_vqp_stop: port Fa0/13
*Mar  1 00:12:57.019: VQPC EVENT: port Fa0/13, REMOVE dynamic access config
*Mar  1 00:12:57.019: VQPC EVENT: deleting all addresses on vlan 0,t Fa0/13
*Mar  1 00:12:57.019: VQPC EVENT: Deleted TCAM catch-all for port Fa0/13
*Mar  1 00:12:57.019: VQPC EVENT: -set_hwidb_vlanid: port Fa0/13 to vlan 0, mac: NULL
*Mar  1 00:12:57.019: VQPC EVENT: changing Fa0/13 to vlan 0
*Mar  1 00:12:58.026: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/13, 
                      changed state to down
*Mar  1 00:12:59.024: %LINK-3-UPDOWN: Interface FastEthernet0/13, changed state to down

Switch#show interfaces fas 0/13 status 

Port      Name     Status       Vlan        Duplex  Speed Type
Fa0/13             err-disabled unassigned  auto    auto 10/100BaseTX

We can see as it has disconnected the interface from the switch and so it shows in the VPMS protocol stats:

Switch#show  vmps statistics
VMPS Client Statistics
----------------------
VQP  Queries:               53
VQP  Responses:             20
VMPS Changes:               0
VQP  Shutdowns:             5
VQP  Denied:                0
VQP  Wrong Domain:          0
VQP  Wrong Version:         0
VQP  Insufficient Resource: 0

As shown, this solution provides more security than the usual solution, improving the mobility in our network. However, it has other security problems we will see in future posts.