HP 5500 HI Series, Configuration Manual

Page: 211 / 444

198
This mode is similar to the macAddressOrUserLoginSecure mode except that a port in this mode
supports multiple 802.1X and MAC authentication users.
•
macAddressElseUserLoginSecure
This mode is the combination of the macAddressWithRadius and userLoginSecure modes, with
MAC authentication having a higher priority as the Else keyword implies.
For wired users, the port performs MAC authentication upon receiving non-802.1X frames and
performs MAC authentication and then, if the authentication fails, 802.1X authentication upon
receiving 802.1X frames.
•
macAddressElseUserLoginSecureExt
This mode is similar to the macAddressElseUserLoginSecure mode except that a port in this mode
supports multiple 802.1X and MAC authentication users as the keyword
Ext implies.
NOTE:
An OUI, as defined by the IEEE, is the first 24 bits of the MAC address, which uniquely identifies a device
vendor.
Working with guest VLAN and Auth-Fail VLAN
An 802.1X guest VLAN is the VLAN that a user is in before initiating authentication. An 802.1X Auth-Fail
VLAN or a MAC authentication guest VLAN is the VLAN that a user is in after failing authentication.
Support for the guest VLAN and Auth-Fail VLAN features varies with security modes.
• You can use the 802.1X guest VLAN and 802.1X Auth-Fail VLAN features together with port security
modes that support 802.1X authentication. For more information about the 802.1X guest VLAN and
Auth-Fail VLAN on a port that performs MAC-based access control, see "
Configuring 802.1X ."
• You can use the MAC authentication VLAN feature together with security modes that support MAC
authentication. For more information about the MAC authentication guest VLAN, see "
Configuring
MAC authentication ."
•
If you configure both an 802.1X Auth-Fail VLAN and a MAC authentication guest VLAN on a port
that performs MAC-based access control, the 802.1X Auth-Fail VLAN has a higher priority.
Configuration task list
Task Remarks
Enabling port security Required.
Setting port security's limit on the number of MAC addresses on a port Optional.
Setting the port security mode Required.
Configuring port security features :
•
Configuring NTK
•
Configuring intrusion protection
•
Enabling port security traps
Optional.
Configure one or more features
as required.
Configuring secure MAC addresses Optional.
Ignoring authorization information Optional.