HP HP 830 Series, Configuration Manual

Page: 327 / 530

315
Item Description
Enable Handshake
Select the box to enable the online user handshake function.
This function enables the network access device to send handshake messages to
online users at the interval set by the Handshake Period setting. If the device does not
receive a response from an online user after the maximum number of handshake
attempts (set by the Retry Times setting), the network access device sets the user in the
offline state. For information about the timers, see " 802.1X timers ."
NOTE:
If the network has 802.1X clients who cannot exchange handshake packets with the
network access device, disable the online user handshake function to prevent their
connections from being inappropriately torn down.
Enable
Re-Authentication
Select the box to enable periodic online user re-authentication on the port.
Periodic online user re-authentication tracks the connection status of online users and
updates the authorization attributes assigned by the server, such as the ACL and
VLAN. The re-authentication interval is specified by the Re-Authentication Period
setting in Table 99 .
NOTE:
•
The periodic online user re-authentication timer can also be set by the
authentication server in the session-timeout attribute. The server-assigned timer
overrides the timer setting on the access device, and enables periodic online user
re-authentication, even if the function is not configured. Support for the server
assignment of re-authentication timer and the re-authentication timer configuration
on the server vary with server models.
•
The VLAN assignment status must be consistent before and after re-authentication.
If the authentication server has assigned a VLAN before re-authentication, it must
also assign a VLAN at re-authentication. If the authentication server has assigned
no VLAN before re-authentication, it must not assign one at re-authentication.
Violation of either rule can cause the user to be logged off. The VLANs assigned to
an online user before and after re-authentication can either be the same or
different.
Guest VLAN
Specify an existing VLAN as the guest VLAN. For more information, see " Configuring
an 802.1X guest VLAN ."
Enable MAC VLAN
Select the box to enable MAC-based VLAN.
This option must be selected when
MAC Based is selected for Port Control .
NOTE:
Only hybrid ports support the feature.
Auth-Fail VLAN
Specify an existing VLAN as the Auth-Fail VLAN to accommodate users who have
failed 802.1X authentication. For more information, see "
Configuring an Auth-Fail
VLAN ."
Configuring an 802.1X guest VLAN
Configuration prerequisites
• Create the VLAN to be specified as the 802.1X guest VLAN.
•
If the 802.1X-enabled port performs port-based access control, enable 802.1X multicast trigger at
the CLI. (802.1X multicast trigger is enabled by default.)