Configuring An 802.1X Critical Vlan; Configuration Guidelines; Configuration Prerequisites; Configuration Procedure - HP 3600 v2 Series Configuration Manual

Step
1. Enter system view.
2. Enter Ethernet interface view.
3. Configure the Auth-Fail VLAN
on the port.

Configuring an 802.1X critical VLAN

Configuration guidelines

• Assign different IDs to the voice VLAN, the port VLAN, and the 802.1X critical VLAN on a port, so
the port can correctly process VLAN tagged incoming traffic.
You can configure only one 802.1X critical VLAN on a port. The 802.1X critical VLANs on different
•
ports can be different.
You cannot specify a VLAN as both a super VLAN and an 802.1X critical VLAN. For information
•
about super VLANs, see Layer 2
If 802.1X clients in your network cannot trigger an immediate DHCP-assigned IP address renewal in
•
response to a VLAN change, the 802.1X users cannot access authorized network resources
immediately after an 802.1X authentication is complete. As a solution, remind the 802.1X users to
release their IP addresses or repair their network connections for a DHCP reassignment after
802.1X authentication is complete. The HP iNode client does not have this problem.

Configuration prerequisites

• Create the VLAN to be specified as a critical VLAN.
If the 802.1X-enabled port performs port-based access control, enable 802.1X multicast trigger
•
(dot1x multicast-trigger).
• If the 802.1X-enabled port performs MAC-based access control, configure the port as a hybrid port,
enable MAC-based VLAN on the port, and assign the port to the Auth-Fail VLAN as an untagged
member. For more information about the MAC-based VLAN function, see Layer 2
Configuration Guide.

Configuration procedure

To configure an 802.1X critical VLAN:
Step
1. Enter system view.
2. Enter Layer 2 Ethernet
interface view.
3. Configure an 802.1X critical
VLAN on the port.
Command
system-view
interface interface-type
interface-number
dot1x auth-fail vlan authfail-vlan-id
LAN Switching Configuration Guide.
—
Command
system-view
interface interface-type
interface-number
dot1x critical vlan vlan-id
92
Remarks
N/A
N/A
By default, no Auth-Fail VLAN is
configured.
LAN Switching
—
Remarks
N/A
N/A
By default, no critical VLAN is
configured.