HP ProCurve 9304M Security Manual page 126

Security Guide for ProCurve 9300/9400 Series Routing Switches
To configure the device to move the port to a restricted VLAN when multi-device port authentication fails, enter
commands such as the following:
ProCurveRS(config)# interface e 3/1
ProCurveRS(config-if-e100-3/1)# mac-authentication auth-fail-action restrict-vlan
100
Syntax: [no] mac-authentication auth-fail-action restrict-vlan [<vlan-id>]
If the ID for the restricted VLAN is not specified at the interface level, the global restricted VLAN ID applies for the
interface.
To specify the VLAN ID of the restricted VLAN globally, enter the following command:
ProCurveRS(config)# mac-authentication auth-fail-vlan-id 200
Syntax: [no] mac-authentication auth-fail-vlan-id <vlan-id>
The command above applies globally to all MAC-authentication-enabled interfaces.
Note that the restricted VLAN must already exist on the device. You cannot configure the restricted VLAN to be a
non-existent VLAN. If the port is a tagged or dual-mode port, you cannot use a restricted VLAN as the
authentication-failure action.
To configure the device to drop traffic from non-authenticated MAC addresses in hardware, enter commands such
as the following:
ProCurveRS(config)# interface e 3/1
ProCurveRS(config-if-e100-3/1)# mac-authentication auth-fail-action block-traffic
Syntax: [no] mac-authentication auth-fail-action block-traffic
Dropping traffic from non-authenticated MAC addresses is the default behavior when multi-device port
authentication is enabled.
Defining MAC Address Filters
You can specify MAC addresses that do not have to go through multi-device port authentication. These MAC
addresses are considered pre-authenticated, and are not subject to RADIUS authentication. To do this, you can
define MAC address filters that specify the MAC addresses to exclude from multi-device port authentication.
You should use a MAC address filter when the RADIUS server itself is connected to an interface where multi­
device port authentication is enabled. If a MAC address filter is not defined for the MAC address of the RADIUS
server and applied on the interface, the RADIUS authentication process would fail since the device would drop all
packets from the RADIUS server itself.
For example, the following command defines a MAC address filter for address 0010.dc58.aca4:
ProCurveRS(config)# mac-authentication mac-filter 1 permit 0010.dc58.aca4
Syntax: [no] mac-authentication mac-filter <filter>
The following commands apply the MAC address filter on an interface so that address 0010.dc58.aca4 is excluded
from multi-device port authentication:
ProCurveRS(config)# interface e 3/1
ProCurveRS(config-if-e100-3/1)# mac-authentication apply-mac-auth-filter 1
Syntax: [no] mac-authentication apply-mac-auth-filter <filter-id>
Configuring Dynamic VLAN Assignment
An interface can be dynamically assigned to a VLAN based on the MAC address learned on that interface. When
a MAC address is successfully authenticated, the RADIUS server sends the HP device a RADIUS Access-Accept
message that allows the HP device to forward traffic from that MAC address. The RADIUS Access-Accept
message can also contain attributes set for the MAC address in its access profile on the RADIUS server.
6 - 4 June 2005