HP E3800 Series, Access Security Manual

Page: 613 / 732

13-41
Configuring Port-Based and User-Based Access Control (802.1X)
802.1X Open VLAN Mode
Effect of RADIUS-assigned VLAN
This rule assumes no other authenticated
clients are already using the port on a
different VLAN.
The port joins the RADIUS-assigned VLAN as an untagged member.
IP Addressing for a Client Connected
to a Port Configured for 802.x Open
VLAN Mode A client can either acquire an IP address from a DHCP server or use
a manually configured IP address before connecting to the switch.
802.1X Supplicant Software for a
Client Connected to a Port Configured
for 802.1X Open VLAN Mode A friendly client, without 802.1X supplicant software, connecting to an
authenticator port must be able to download this software from the
Unauthorized-Client VLAN before authentication can begin.
Switch with a Port Configured To
Allow Multiple Authorized-Client
Sessions When a new client is authenticated on a given port:
• If no other clients are authenticated on that port, then the port joins
one VLAN in the following order of precedence:
a. A RADIUS-assigned VLAN, if configured.
b. An Authenticated-Client VLAN, if configured.
c. A static, port-based VLAN to which the port belongs as an
untagged member.
d. Any VLAN(s) to which the port is configured as a tagged
member (provided that the client can operate in that VLAN).
• If another client is already authenticated on the port, then the port
is already assigned to a VLAN for the previously-existing client
session, and the new client must operate in this same VLAN,
regardless of other factors. (This means that a client without 802.1X
client authentication software cannot access a configured,
Unauthenticated-Client VLAN if another, authenticated client is
already using the port.)
Condition Rule