HP 10500 series, Security Configuration Manual, Page: 129 / 596

115
VLAN assignment
MAC authentication supports the authorization VLAN, guest VLAN, and critical VLAN.
Authorization VLAN
You can specify the authorization VLAN for a MAC authentication user to control access to
authorized network resources.
•
On a RADIUS server, the authorization VLAN can be specified in the form of VLAN ID or VLAN
name.
•
On the local access device, the authorization VLAN must be specified in the form of VLAN ID.
You can specify the authorization VLAN in the following views:
{
Local user view.
{
User group view.
For more information about local authorization VLAN configuration, see " Configuring AAA ."
When the MAC authentication user passes authentication, the authentication server (either the local
access device or a RADIUS server) assigns the authorization VLAN to the user.
The port through which the user accesses the device is assigned to the authorization VLAN. A hybrid
port is always assigned to a server-assigned authorization VLAN as an untagged member. After the
assignment, do not reconfigure the port as a tagged member in the VLAN.
Table 9 describes the way the network access device handles authorization VLANs for MAC
authenticated users.
Table 9 VLAN manipulation
Port type VLAN manipulation
•
Access port
•
Trunk port
•
Hybrid port with
MAC-based-VLAN disabled
The device assigns the first authenticated user's authorization VLAN
to the port as the PVID.
NOTE:
For these port types, you must assign the same authorization VLAN
to all MAC authentication users on a port. If a different authorization
VLAN is assigned to a subsequent user, the user cannot pass MAC
authentication.
Hybrid port with MAC-based VLAN
enabled
The device maps the MAC address of each user to the authorization
VLAN. The PVID of the port does not change. When a user logs off,
the MAC-to-VLAN mapping for the user is removed.
Guest VLAN
You can configure a MAC authentication guest VLAN on a port to accommodate users that have
failed MAC authentication on the port. Users in the MAC authentication guest VLAN can access a
limited set of network resources, such as a software server, to download software and system
patches. If no MAC authentication guest VLAN is configured, the users that have failed MAC
authentication cannot access any network resources.
A hybrid port is always assigned to a MAC authentication guest VLAN as an untagged member. After
the assignment, do not reconfigure the port as a tagged member in the VLAN.
Table 10 shows the way that the network access device handles guest VLANs for MAC
authentication users.