MAC Learning and Provisioning of VLAN

The first step in determining VLAN configuration for an identity is to learn the identity‘s MAC. For untagged traffic the port is added as untagged to a “catcher/learning” VLAN that is used to learn MACs. Identity Management (IDM) role based VLAN is not supported for tagged traffic.

Upon receiving the first packet from the identity, the following actions are completed:

FDB (forwarding database) Manager learns the identity‘s MAC and informs IDM.
IDM creates an identity for the newly learned MAC and determines the role for the identity.
IDM checks the role‘s configuration to see if the identities in this role need to be associated with a VLAN.
If the identity in this role is associated with a VLAN tag, IDM checks to see if a VLAN with the configured tag is already present.
If not, IDM creates VLAN “SYS_VLAN_<Configured-Role-VLAN-Tag>” and adds the port (on which the identity is detected) to VLAN “SYS_VLAN_< Configured-Role-VLAN-Tag>” as untagged. If a VLAN with configured tag already exists, IDM simply adds the port to the VLAN as untagged.
In addition, IDM adds a MAC entry for identity‘s MAC in the hardware to classify all untagged traffic from this identity to be associated with VLAN “SYS_VLAN_<Configured-Role-VLAN-Tag>”.
IDM does not explicitly add uplink ports to VLAN “SYS_VLAN_<Configured-Role-VLAN-Tag>”. It is assumed that user would have enabled MVRP on the uplink ports or the uplink ports are configured statically. Creation of the VLAN is sufficient for MVRP to advertise membership for VLAN “SYS_VLAN_<Configured-Role-VLAN-Tag>” over those ports.
If no VLAN configuration exists for Role, IDM adds a MAC entry to associate identity‘s MAC with the default/base VLAN configured for the port.

Note

All of the IDM enabled ports should be part of a default/base VLAN to enable IDM role based VLAN on the port.

Tagged Traffic from Identity

Note

This section assumes that the IDM enabled port and the uplink ports are already added to the VLAN as tagged.

FDB Manager learns the identity‘s MAC and informs IDM.
IDM creates an identity for the newly learned MAC and determines the role for the identity.
IDM checks the role‘s configuration to see if the identities in this role need to be associated with a VLAN.
If the identity in this role is associated with a VLAN tag, IDM checks to see if a VLAN with configured tag is already present.
IDM also checks if the role configured tag matches the incoming VLAN tag of the identity. If not, an error is generated.

Untagged Traffic from Identity

The following figure shows a topology of untagged traffic from an identity:

Untagged Traffic Topology

FDB Manager learns the identity‘s MAC on Switch1‘s port P1 and informs IDM.
IDM creates an identity for this MAC and determine the role for this new identity. IDM checks Role configuration to see if the identities in this role is associated with a VLAN.
If the identity in this role is associated with a VLAN tag (say VLAN ID 100), IDM checks to see if a VLAN with tag 100 is already present. [If VLAN is already present the assumption is the user has already added the uplink port to the VLAN].
If not IDM will create VLAN “SYS_VLAN_100” on Switch 1 and adds port P1 to VLAN “SYS_VLAN_100” as untagged. If a VLAN with tag 100 already exists, IDM simply adds the port to the VLAN as untagged.
In addition IDM will add a MAC entry for identity‘s MAC in H/W to classify all untagged traffic from this identity to be associated with VLAN “SYS_VLAN_100”.
IDM does not explicitly add uplink ports (ports P3 & P4) in this case to VLAN “SYS_VLAN_100”. It is assumed that user would have enabled MVRP on the uplink ports or the uplink ports are configured statically. Creation of the VLAN is sufficient for MVRP to advertise membership for VLAN “SYS_VLAN_100” over those ports.
If no VLAN configuration exists for Role, IDM adds a MAC entry to associate identity‘s MAC with the default/base VLAN configured for the port.

Published March 2020prev | next

Email this topic

Print this page Print this page

Leave feedback Feedback