Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to design a topology in which I need to use VMPS and unfortunately the resources are rather few on the internet.

Based on this Configuration document


I have created a sample configuration document. However I see in it a particular command, viz

download vmps

Which I believe creates a copy of the VMPS database from the TFTP server to the NVRAM.

Now my question is: Are any of my assumptions above true? Is that the method to create a more permanent copy of the VMPS database into the NVRAM ? Is there any way for the VMPS database to be edited and management from the Catalyst switch itself or does it always have to be updated via the TFTP Server?

Finally does anyone have any authoritative document or tech notes for the VMPS? I have not seen this particular technology in the syllabi of either CCNA, CCNP or even CCIE.


share|improve this question
what do you want achieve? Is the technology you can use set in stone? – cstamas Sep 16 '11 at 22:10
Nothing set in stone, just that this is the only pure switching technology I could find. I am open to other alternatives to achieve the dynamic assignment of Vlans based on MAC Address. – gokul varma nk Sep 17 '11 at 1:38
up vote 1 down vote accepted

VMPS is deprecated now so I would advise against using it. The mac authentication bypass feature of 802.1X is what you really ought to be using for this type of application. This does require you to have a radius or tacacs server though.

Cisco MAC authentication bypass

There's some discussion on how to implement this in a Microsoft environment here

To directly answer your questions - If I recall correctly the database is loaded into memory, not nvram so if switch is reloaded the database needs downloading again. The VPMS database can only be updated via the tftp server.

I think the configuration guide you already have might be as good as the documentation gets but this might be of some use to you if you haven't come across it already. The Cisco support forums usualy have a lot of useful information buried in them.

share|improve this answer
Thank you, this seems to be the solution I need. – gokul varma nk Sep 20 '11 at 8:58

I found a better alternative to both VMPS and other Server based authentication based Vlan assignment. I found out that it can be done per switch using macros.

Using that I have created sample configurations like this:

configure terminal
    macro auto mac-address-group ServerVlan
        oui list 001222 
    macro auto execute ServerVlan {
    macro auto execute MP_EVENT { 
        if [[ $LINKUP -eq YES ]]; then 
            conf t 
            interface $INTERFACE 
            macro description $TRIGGER 
            switchport access vlan 2 
            switchport mode access 
            switchport port-security 
            switchport port-security maximum 1 
            switchport port-security violation restrict 
            switchport port-security aging time 2 
            switchport port-security aging type inactivity 
            spanning-tree portfast 
            spanning-tree bpduguard enable 

Hopefully this would work.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.