3Com OfficeConnect WX4400, Справочное руководство

Страница: 215 / 528

Viewing and Configuring VLANs 215
Viewing and
Configuring VLANs
A virtual LAN (VLAN) is a Layer 2 broadcast domain that can span multiple
wired or wireless LAN segments. Each VLAN is a separate logical network,
and, if you configure IP interfaces on the VLANs, MSS treats each VLAN
as a separate IP subnet.
Configure VLANs on the network ports of a WX switch by configuring
them on the switch itself. Configure a VLAN by assigning a name and
network ports to the VLAN. Optionally, you can assign VLAN tag values
on individual network ports. You can configure multiple VLANs on the
network port of a WX switch. Optionally, each VLAN can have an IP
address.
You do not need to configure VLANs on MAP access ports or wired
authentication ports, because the VLAN membership of these types of
ports is determined dynamically through the authentication and
authorization process. Users who require authentication connect through
WX ports that are configured for MAPs or wired authentication access.
Users are assigned to VLANs automatically through authentication and
authorization mechanisms such as 802.1X.
By default, none of the ports of a WX switch are in VLANs. A switch
cannot forward traffic on the network until you configure VLANs and add
network ports to those VLANs.
Users and VLANs
When a user successfully authenticates to the network, the user is
assigned to a specific VLAN. A user remains associated with the same
VLAN throughout the user’s session on the network, even when roaming
from one WX switch to another within the Mobility Domain.
You assign a user to a VLAN by setting one of the following attributes on
the RADIUS servers or in the local WX user database:
„
Tunnel-Private-Group-ID—This attribute is described in RFC 2868,
RADIUS Attributes for Tunnel Protocol Support .
„
VLAN-Name—This attribute is a 3Com vendor-specific attribute (VSA).
You cannot configure the Tunnel-Private-Group-ID attribute in the local
user database.