Configuring Access Guardian Interaction With Other Features
OmniSwitch AOS Release 8 Network Configuration Guide December 2017 page 28-27
• Configuring a static MAC address is not allowed on a UNP port unless LPS is also enabled on the
same port.
• When both LPS and UNP are enabled on the same port,
– UNP first authenticates and classifies any MAC addresses received, then LPS rules are applied.
– If a MAC address violates any of the LPS rules for the port, the address may get filtered or the port
violated even if UNP initially determined the address was valid. In other words, LPS rules take
precedence over UNP to determine if a MAC address is bridged or filtered on the port.
• If UNP classifies a MAC address as learning but LPS learns the address as filtering, an untagged
packet will show as filtering in the default VLAN for the port and a tagged packet MAC will show as
filtering in the specific tagged VLAN.
• When a MAC address is filtered by LPS, the show unp user status command will display “LPS-
Blocked” as the classification source for that MAC address.
There are some LPS commands and command options that are not supported on UNP ports. For more
information about these exceptions and other conditions for using UNP and LPS on the same port, see
Chapter 47, “Learned Port Security Commands,” in the OmniSwitch AOS Release 8 CLI Reference Guide.
Multiple VLAN Registration Protocol (MVRP)
MVRP is not supported on UNP ports, however, both features can co-exist on the same switch. The
recommended configuration is to have UNP dynamically create VLAN-port-associations on UNP bridge
ports while MVRP propagates the dynamic VLANs down and up stream.
UNP supports a dynamic VLAN profile configuration option. When this option is enabled, tagged packets
received on UNP ports that are enabled to trust the VLAN tag, are classified based on the VLAN tag of
the packet. If the VLAN tag matches a MVRP VLAN on the switch and the MVRP VLAN is not already
assigned to a profile, the following occurs:
• A new profile is automatically created and associated with the MVRP VLAN.
• The MVRP VLAN is converted to a UNP dynamic VLAN if the UNP dynamic VLAN configuration
option is also enabled for the switch.
Quality of Service (QoS)
The Access Guardian feature provides the ability to assign a list of QoS policy rules to a UNP. The rules
contained in the list are applied to any device that is assigned to the UNP. Consider the following
guidelines when configuring policy lists for user profiles:
• QoS policy rules and policy lists are configured using the OmniSwitch QoS feature. Configuration of
these items is required before the list is assigned to a UNP.
• Configuring QoS policy lists is not allowed if VLAN Stacking Services or if QoS inner VLAN or inner
802.1Q tag policies are configured for the switch.
• Only one QoS policy list per UNP is allowed, but multiple profiles can use the same UNP. Up to 32
policy lists (including the default list) are allowed per switch.
• A default QoS policy list always exists in the switch configuration. Any QoS policies that are not
assigned to a user profile belong to the default list, unless specified otherwise when the policy is
created.
To Next Page
Loading...
Need help?
General
