Applying Nas-Id Profile To Port Security - HP FlexFabric 5700 Series Security Configuration Manual

If MAC move is disabled and an 802.1X authenticated user moves to another port, the user is not
reauthenticated.
HP recommends you enable MAC move for wireless users that roam between ports to access the
network.
To enable MAC move:
Step
1. Enter system view.
2. Enable MAC move.

Applying NAS-ID profile to port security

By default, the device sends its device name in the NAS-Identifier attribute of any RADIUS requests.
A NAS-ID profile enables you to send different NAS-Identifier attribute strings in RADIUS requests from
different VLANs. The strings can be organization names, service names, or any user categorization
criteria, depending on the administrative requirements.
For example, map the NAS-ID companyA to all VLANs of company A. The device will send companyA
in the NAS-Identifier attribute for the RADIUS server to identify requests from any Company A users.
You can apply a NAS-ID profile to port security globally or on a port. On a port, the device selects a
NAS-ID profile in the following order:
1. The port-specific NAS-ID profile.
2. The NAS-ID profile applied globally.
If no NAS-ID profile is applied or no matching binding is found in the selected profile, the device uses the
device name as the NAS-ID.
For more information about the NAS-ID profile configuration, see
To apply a NAS-ID profile to port security:
Step
1. Enter system view.
2. Apply a NAS-ID profile.
Command
system-view
port-security mac-move permit
Command
system-view
•
In system view:
port-security nas-id-profile
profile-name
•
In Layer 2 Ethernet interface
view:
a. interface interface-type
interface-number
b. port-security
nas-id-profile
profile-name
183
Remarks
N/A
By default, MAC move is disabled.
"Configuring AAA."
Remarks
N/A
By default, no NAS-ID profile is
applied in system view or in Layer
2 Ethernet interface view.