Vlan Membership Priority - HP ProCurve 6400cl Series Access Security Manual
Hide thumbs
Also See for ProCurve 6400cl Series:
- Management and configuration manual (508 pages) ,
- Installation and getting started manual (84 pages) ,
- Management manual (664 pages)
Table of Contents
Advertisement
N o t e
Note for 5300xl
Switches
5300xl switches running software release E.09.xx or greater use the extended
802.1X client-based authentication. 3400cl and 6400cl switches (and 5300xl
switches running a software version earlier than E.09.xx) use 802.1X port-
based authentication. For more information, refer to "User Authentication
Methods" on page 10-4.
VLAN Membership Priority
Following client authentication, an 802.1X port resumes membership in any
tagged VLANs for which it is already assigned in the switch configuration. The
port also becomes an untagged member of one VLAN according to the follow
ing order of options:
a.
1st Priority: The port joins a VLAN to which it has been assigned by
a RADIUS server during client authentication.
b. 2nd Priority: If RADIUS authentication does not include assigning
the port to a VLAN, then the switch assigns the port to the VLAN
entered in the port's 802.1X configuration as an Authorized-Client
VLAN, if configured.
c.
3rd Priority: If the port does not have an Authorized-Client VLAN
configured, but does have a static, untagged VLAN membership in its
configuration, then the switch assigns the port to this VLAN.
A port assigned to a VLAN by an Authorized-Client VLAN configuration
(or a RADIUS server) will be an untagged member of the VLAN for the
duration of the authenticated session. This applies even if the port is also
configured in the switch as a tagged member of the same VLAN.
Note that 3400cl and 6400cl switches (and 5300xl switches running a
software release earlier than E.09.xx) handle the presence of a previously
authenticated client on a port differently than 5300xl switches running
software release E.09.xx or greater. Refer to "User Authentication Meth
ods" on page 10-4.
On 5300xl switches running software release E.09.xx or greater, using the
same port for both RADIUS-assigned clients and clients using a config
ured, Authorized-Client VLAN is not recommended. This is because doing
so can result in authenticated clients with mutually exclusive VLAN
priorities, which means that some authenticated clients can be denied
access to the port. Refer to figure 10-1 on page 10-10.
Configuring Port-Based and Client-Based Access Control (802.1X)
General 802.1X Authenticator Operation
10-9
Advertisement
Table of Contents
