Configuration Prerequisites; Configuration Procedure; Enabling 802.1X Guest Vlan Assignment Delay - HPE Moonshot 45Gc Security Configuration Manual

•
Assign different IDs to the voice VLAN, the port VLAN, and the 802.1X guest VLAN on a port.
The assignment makes sure the port can correctly process incoming VLAN-tagged traffic.
•
When you configure multiple security features on a port, follow the guidelines in
Table 7 Relationships of the 802.1X guest VLAN and other security features
Feature
Super VLAN
802.1X Auth-Fail VLAN on
a port that performs
MAC-based access
control
Port intrusion protection
actions on a port that
performs MAC-based
access control

Configuration prerequisites

Before you configure an 802.1X guest VLAN, complete the following tasks:
•
Create the VLAN to be specified as the 802.1X guest VLAN.
•
If the 802.1X-enabled port performs MAC-based access control, perform the following
operations for the port:
Configure the port as a hybrid port.
Enable MAC-based VLAN on the port. For more information about the MAC-based VLAN
feature, see Layer 2—LAN Switching Configuration Guide.
Assign the port to the 802.1X guest VLAN as an untagged member.

Configuration procedure

To configure an 802.1X guest VLAN:
Step
1. Enter system view.
2. Enter Ethernet interface
view.
3. Configure the 802.1X guest
VLAN on the port.

Enabling 802.1X guest VLAN assignment delay

This feature delays assigning an 802.1X-enabled port to the 802.1X guest VLAN when the port
receives a packet from an unknown MAC address.
To use this feature, the 802.1X-enabled port must meet the following requirements:
•
Perform MAC-based access control.
Relationship description
You cannot specify a VLAN as both a super VLAN
and an 802.1X guest VLAN.
The 802.1X Auth-Fail VLAN has a higher priority
than the 802.1X guest VLAN.
The 802.1X guest VLAN feature has higher
priority than the block MAC action.
The 802.1X guest VLAN feature has lower priority
than the shutdown port action of the port intrusion
protection feature.
Command
system-view
interface interface-type
interface-number
dot1x guest-vlan guest-vlan-id
87
Table
Reference
See Layer 2—LAN
Switching Configuration
Guide.
See "802.1X VLAN
manipulation."
See "Configuring port
security."
Remarks
N/A
N/A
By default, no 802.1X guest VLAN
is configured on any port.
7.