HP E3800 Series, Access Security Manual

Page: 643 / 732

13-71
Configuring Port-Based and User-Based Access Control (802.1X)
How RADIUS/802.1X Authentication Affects VLAN Operation
• If the port is assigned as a member of an untagged dynamic VLAN
that was learned through GVRP, the dynamic VLAN configuration
must exist on the switch at the time of authentication and GVRP-
learned dynamic VLANs for port-access authentication must be
enabled.
If the dynamic VLAN does not exist or if you have not enabled the use
of a dynamic VLAN for authentication sessions on the switch, the
authentication fails.
■ To enable the use of a GVRP-learned (dynamic) VLAN as the untagged
VLAN used in an authentication session, enter the
aaa port-access gvrp-
vlans command, as described in “Enabling the Use of GVRP-Learned
Dynamic VLANs in Authentication Sessions” on page 13-75.
■ Enabling the use of dynamic VLANs in an authentication session offers
the following benefits:
• You avoid the need of having static VLANs pre-configured on the
switch.
• You can centralize the administration of user accounts (including user
VLAN IDs) on a RADIUS server.
For information on how to enable the switch to dynamically create
802.1Q-compliant VLANs on links to other devices using the GARP VLAN
Registration Protocol (GVRP), see the chapter on “GVRP” in the
Advanced
Traffic Management Guide.
■ For an authentication session to proceed, a port must be an untagged
member of the (static or dynamic) VLAN assigned by the RADIUS server
(or an authorized-client VLAN configuration). The port temporarily drops
any current untagged VLAN membership.
If the port is not already a member of the RADIUS-assigned (static or
dynamic) untagged VLAN, the switch temporarily reassigns the port as an
untagged member of the required VLAN (for the duration of the session).
At the same time, if the port is already configured as an untagged
member of a different VLAN, the port loses access to the other VLAN for
the duration of the session.
(A port can be an untagged member of only
one VLAN at a time.)
When the authentication session ends, the switch removes the temporary
untagged VLAN assignment and re-activates the temporarily disabled,
untagged VLAN assignment.
■ If GVRP is already enabled on the switch, the temporary untagged (static
or dynamic) VLAN created on the port for the authentication session is
advertised as an existing VLAN.