Example Of Untagged Vlan Assignment In A Radius-Based Authentication Session - HP ProCurve Series 3400cl Release Notes

Enhancements
Release M.10.33 Enhancements
When the authentication session ends, the switch removes the temporary untagged VLAN
assignment and re-activates the temporarily disabled, untagged VLAN assignment.
■ If GVRP is already enabled on the switch, the temporary untagged (static or dynamic) VLAN
created on the port for the authentication session is advertised as an existing VLAN.
If this temporary VLAN assignment causes the switch to disable a different untagged static or
dynamic VLAN configured on the port, the disabled VLAN assignment is not advertised. When
the authentication session ends, the switch:
• Removes the temporary untagged VLAN assignment and stops advertising it.
• Re-activates and resumes advertising the temporarily disabled, untagged VLAN assignment.
If you modify a VLAN ID configuration on a port during an 802.1X, MAC, or Web authentication
■
session, the changes do not take effect until the session ends.
■ When a switch port is configured with RADIUS-based authentication to accept multiple 802.1X
and/or MAC or Web authentication client sessions, all authenticated clients must use the same
port-based, untagged VLAN membership assigned for the earliest, currently active client session.
Therefore, on a port where one or more authenticated client sessions are already running, all
such clients are on the same untagged VLAN. If a RADIUS server subsequently authenticates a
new client, but attempts to re-assign the port to a different, untagged VLAN than the one already
in use for the previously existing, authenticated client sessions, the connection for the new client
will fail.

Example of Untagged VLAN Assignment in a RADIUS-Based Authentication Session

The following example shows how an untagged static VLAN is temporarily assigned to a port for use
during an 802.1X authentication session. In the example, an 802.1X-aware client on port A2 has been
authenticated by a RADIUS server for access to VLAN 22. However, port A2 is not configured as a
member of VLAN 22 but as a member of untagged VLAN 33 as shown in Figure
104
Figure 8.