HP ProCurve 6400cl Series Access Security Manual page 303

Condition
Effect of Failed Client Authentication
Attempt
5300xl Running Software Release E.09.xx
or Greater: This rule assumes no other
authenticated clients are already using
the port on a different VLAN.
Effect of RADIUS-assigned VLAN
5300xl Running Software Release E.09.xx
or Greater: This rule assumes no other
authenticated clients are already using
the port on a different VLAN.
IP Addressing for a Client Connected
to a Port Configured for 802.x Open
VLAN Mode
802.1X Supplicant Software for a
Client Connected to a Port Configured
for 802.1X Open VLAN Mode
5300xl Running Software Release
E.09.xx or Greater, with a Port
Configured To Allow Multiple
Authorized-Client Sessions
Configuring Port-Based and Client-Based Access Control (802.1X)
Rule
When there is an Unauthorized-Client VLAN configured on an 802.1X
authenticator port, an unauthorized client connected to the port has
access only to the network resources belonging to the Unauthorized-
Client VLAN. This access continues until the client disconnects from
the port. (If there is no Unauthorized-Client VLAN configured on the
authenticator port, the port simply blocks access for any unauthorized
client.)
The port joins the RADIUS-assigned VLAN as an untagged member.
A client can either acquire an IP address from a DHCP server or use
a manually configured IP address before connecting to the switch.
A friendly client, without 802.1X supplicant software, connecting to an
authenticator port must be able to download this software from the
Unauthorized-Client VLAN before authentication can begin.
When a new client is authenticated on a given port:
• If no other clients are authenticated on that port, then the port joins
one VLAN in the following order of precedence:
a. A RADIUS-assigned VLAN, if configured.
b. An Authenticated-Client VLAN, if configured.
c. A static, port-based VLAN to which the port belongs as an
untagged member.
d. Any VLAN(s) to which the port is configured as a tagged
member (provided that the client can operate in that VLAN).
• If another client is already authenticated on the port, then the port
is already assigned to a VLAN for the previously-existing client
session, and the new client must operate in this same VLAN,
regardless of other factors. (This means that a client without 802.1X
client authentication software cannot access a configured,
Unauthenticated-Client VLAN if another, authenticated client is
already using the port.)
802.1X Open VLAN Mode
10-29