HP ProCurve J8766A Release Note page 86

Enhancements
Release L.11.08 Enhancements
VLAN Assignment on a ProCurve Port
Following client authentication, VLAN configurations on a ProCurve port are managed as follows
when you use 802.1X, MAC, or Web authentication:
■ The port resumes membership in any tagged VLANs for which it is already assigned in the
switch configuration. Tagged VLAN membership allows a port to be a member of multiple
VLANs simultaneously.
■ The port is temporarily assigned as a member of an untagged (static or dynamic) VLAN for
use during the client session according to the following order of options.
a. The port joins the VLAN to which it has been assigned by a RADIUS server during client
authentication.
b. If RADIUS authentication does not include assigning the port to a VLAN, then the switch
assigns the port to the authorized-client VLAN configured for the authentication method.
c. If the port does not have an authorized-client VLAN configured, but is configured for
membership in an untagged VLAN, the switch assigns the port to this untagged VLAN.
Operating Notes
During client authentication, a port assigned to a VLAN by a RADIUS server or an authorized-
■
client VLAN configuration is an untagged member of the VLAN for the duration of the
authenticated session. This applies even if the port is also configured in the switch as a tagged
member of the same VLAN. The following restrictions apply:
• If the port is assigned as a member of an untagged static VLAN, the VLAN must already
be configured on the switch. If the static VLAN configuration does not exist, the
authentication fails.
• If the port is assigned as a member of an untagged dynamic VLAN that was learned
through GVRP, the dynamic VLAN configuration must exist on the switch at the time of
authentication and GVRP-learned dynamic VLANs for port-access authentication must
be enabled
If the dynamic VLAN does not exist or if you have not enabled the use of a dynamic VLAN
for authentication sessions on the switch, the authentication fails.
■ To enable the use of a GVRP-learned (dynamic) VLAN as the untagged VLAN used in an
authentication session, enter the aaa port-access gvrp-vlans command.
■ Enabling the use of dynamic VLANs in an authentication session offers the following benefits:
• You avoid the need of having static VLANs pre-configured on the switch.
• You can centralize the administration of user accounts (including user VLAN IDs) on a
RADIUS server.
80