Configuring An 802.1X Guest Vlan; Configuring An Auth-Fail Vlan - HP 6600 Security Configuration Manual

If no critical VLAN is configured, RADIUS server unreachable can cause an online user being
re-authenticated to be logged off. If a critical VLAN is configured, the user remains online and in the
original VLAN.

Configuring an 802.1X guest VLAN

Follow these guidelines when you configure an 802.1X guest VLAN:
• You can configure only one 802.1X guest VLAN on a port. The 802.1X guest VLANs on different
ports can be different.
Assign different IDs to the voice VLAN, the port VLAN, and the 802.1X guest VLAN on a port, so
•
the port can correctly process incoming VLAN tagged traffic.
You cannot specify a VLAN as both a super VLAN and an 802.1X guest VLAN. For more
•
information about super VLAN, see Layer 2—LAN Switching Configuration Guide.
Before configuring an 802.1X guest VLAN, complete the following tasks:
Create the VLAN to be specified as the 802.1X guest VLAN.
•
• Enable 802.1X multicast trigger on the 802.1X-enabled port performs port-based access control.
To configure an 802.1X guest VLAN:
Step
1. Enter system view.
2. Configure an 802.1X
guest VLAN for one or
more ports in system
view or Ethernet
interface view.

Configuring an Auth-Fail VLAN

Follow these guidelines when configuring an 802.1X Auth-Fail VLAN:
Assign different IDs to the port VLAN and the 802.1X Auth-Fail VLAN on a port, so the port can
•
correctly process VLAN tagged incoming traffic.
You can configure only one 802.1X Auth-Fail VLAN on a port. The 802.1X Auth-Fail VLANs on
•
different ports can be different.
• Use Table 7
Table 7 Relationships of the 802.1X Auth-Fail VLAN with other features
Feature
Super VLAN
Command
system-view
•
In system view:
dot1x guest-vlan guest-vlan-id [ interface
interface-list ]
•
In Ethernet interface view:
a. interface interface-type
interface-number
b. dot1x guest-vlan guest-vlan-id
when configuring multiple security features on a port.
Relationship description
You cannot specify a VLAN as both a super
VLAN and an 802.1X Auth-Fail VLAN.
96
Remarks
N/A
By default, no 802.1X guest
VLAN is configured on any
port.
Reference
See Layer 2—LAN Switching
Configuration Guide.