HP HP ProCurve Series 6600, Access Security Manual

Page: 684 / 778

13-72
Configuring Port-Based and User-Based Access Control (802.1X)
How RADIUS/802.1X Authentication Affects VLAN Operation
If this temporary VLAN assignment causes the switch to disable a different
untagged static or dynamic VLAN configured on the port (as described in
the preceding bullet and in “Example of Untagged VLAN Assignment in a
RADIUS-Based Authentication Session” on page 13-72), the disabled
VLAN assignment is not advertised. When the authentication session
ends, the switch:
• Removes the temporary untagged VLAN assignment and stops adver-
tising it.
• Re-activates and resumes advertising the temporarily disabled,
untagged VLAN assignment.
■ If you modify a VLAN ID configuration on a port during an 802.1X, MAC,
or Web authentication session, the changes do not take effect until the
session ends.
■ When a switch port is configured with RADIUS-based authentication to
accept multiple 802.1X and/or MAC or Web authentication client sessions,
all authenticated clients must use the same port-based, untagged VLAN
membership assigned for the earliest, currently active client session.
Therefore, on a port where one or more authenticated client sessions are
already running, all such clients are on the same untagged VLAN (unless
MAC-based VLANs are enabled. Please see “MAC-Based VLANs” on
page 6-51). If a RADIUS server subsequently authenticates a new client,
but attempts to re-assign the port to a different, untagged VLAN than the
one already in use for the previously existing, authenticated client ses-
sions, the connection for the new client will fail.
Example of Untagged VLAN Assignment in a RADIUS-
Based Authentication Session
The following example shows how an untagged static VLAN is temporarily
assigned to a port for use during an 802.1X authentication session. In the
example, an 802.1X-aware client on port A2 has been authenticated by a
RADIUS server for access to VLAN 22. However, port A2 is not configured as
a member of VLAN 22 but as a member of untagged VLAN 33 as shown in
Figure 13-20.