Acl Assignment - HPE Moonshot 45Gc Security Configuration Manual

Authentication status
authentication for any other
reason than server unreachable.
A user in the MAC authentication
guest VLAN passes MAC
authentication.
Critical VLAN
You can configure a MAC authentication critical VLAN on a port to accommodate users that fail MAC
authentication because no RADIUS authentication server is reachable. Users in a MAC
authentication critical VLAN can access only network resources in the critical VLAN.
The critical VLAN feature takes effect when MAC authentication is performed only through RADIUS
servers. If a MAC authentication user fails local authentication after RADIUS authentication, the user
is not assigned to the critical VLAN. For more information about the authentication methods, see
"Configuring AAA."
Table 11 shows the way that the network access device handles critical VLANs for MAC
authentication users.
Table 11 VLAN manipulation
Authentication status
A user that has not been assigned to any VLAN
fails MAC authentication because all the
RADIUS servers are unreachable.
A user in the MAC authentication critical VLAN
fails MAC authentication for any other reason
than server unreachable.
A user in the MAC authentication critical VLAN
passes MAC authentication.

ACL assignment

You can specify an authorization ACL in the user account for a MAC authentication user to control
the user's access to network resources. After the user passes MAC authentication, the
authentication server (local or remote) assigns the authorization ACL to the access port of the user.
The ACL will filter traffic for this user. You must configure ACL rules for the authorization ACL on the
access device for the ACL assignment feature.
To ensure a successful ACL assignment, make sure the ACL does not contain rules that match
source MAC addresses.
To change the access control criteria for the user, you can use one of the following methods:
•
Modify ACL rules on the access device.
•
Specify another authorization ACL on the authentication server.
For more information about ACLs, see ACL and QoS Configuration Guide.
VLAN manipulation
The device remaps the MAC address of the user to the authorization
VLAN assigned by the authentication server.
If no authorization VLAN is configured for the user on the authentication
server, the device remaps the MAC address of the user to the PVID of
the port.
VLAN manipulation
The device maps the MAC address of the user to the MAC
authentication critical VLAN.
The user is still in the MAC authentication critical VLAN if
the user fails MAC reauthentication because all the
RADIUS servers are unreachable.
If a guest VLAN has been configured, the device maps the
MAC address of the user to the guest VLAN.
If no guest VLAN is configured, the device remaps the
MAC address of the user to the PVID of the port.
The device remaps the MAC address of the user to the
authorization VLAN assigned by the authentication server.
If no authorization VLAN is configured for the user on the
authentication server, the device remaps the MAC
address of the user to the PVID of the access port.
105