Configuring An Auth-Fail Vlan; 802.1X Configuration Examples; Mac-Based 802.1X Configuration Example - HP FlexNetwork NJ5000 User Manual

Feature
performs MAC-based access control

Configuring an Auth-Fail VLAN

Configuration prerequisites
•
Create the VLAN to be specified as the 802.1X Auth-Fail VLAN.
•
If the 802.1X-enabled port performs MAC-based access control, configure the port as a hybrid
port, enable MAC-based VLAN on the port, and assign the port to the Auth-Fail VLAN as an
untagged member.
Configuration guidelines
•
The 802.1X Auth-Fail VLANs on different ports can be different.
•
Assign different IDs to the port VLAN and the 802.1X Auth-Fail VLAN on a port, so the port can
correctly process VLAN tagged incoming traffic.
•
Use Table 100
Table 100 Relationships of the 802.1X Auth-Fail VLAN with other features
Feature
MAC authentication guest VLAN on a port that
performs MAC-based access control
Port intrusion protection on a port that
performs MAC-based access control

802.1X configuration examples

MAC-based 802.1X configuration example

Network requirements
As shown in
port GigabitEthernet 1/0/1. Implement MAC-based access control on the port, so the logoff of one
user does not affect other online 802.1X users. Enable periodic re-authentication of online users on
the port, so that the server can periodically update the authorization information of the users.
Use RADIUS servers to perform authentication, authorization, and accounting for the 802.1X users.
If RADIUS accounting fails, the access device logs the user off. The RADIUS servers run CAMS or
IMC.
Configure the host at 10.1.1.1 as the primary authentication and secondary accounting servers, and
the host at 10.1.1.2 as the secondary authentication and primary accounting servers. Assign all
users to the ISP domain test.
Configure the shared key as name for packets between the access device and the authentication
server, and the shared key as money for packets between the access device and the accounting
server.
Exclude the ISP domain name from the username sent to the RADIUS servers.
when configuring multiple security features on a port.
Figure 276, the access device performs 802.1X authentication for users that connect to
Relationship description
than the shutdown port action of the port intrusion
protection feature.
Relationship description
The 802.1X Auth-Fail VLAN has a high priority.
The 802.1X Auth-Fail VLAN function has higher
priority than the block MAC action, but it has lower
priority than the shutdown port action of the port
intrusion protection feature.
266