Additional Radius Attributes - HP E3800-24G-PoE+-2SFP+ Access Security Manual

Tunnel (untagged VLAN) attributes may be included in the same RADIUS
packet as the Egress-VLANID and Egress-VLAN-Name attributes. These
attributes are not mutually exclusive.
The switch processes the VLAN information returned from the remote
RADIUS server for each successfully 802.1X-, Web-, and MAC-authenticated
client (user). The VLAN information is part of the user's profile stored in the
RADIUS server's database and is applied if the VLANs exist on the switch.
The support for RADIUS-assigned tagged and untagged VLAN configuration
on an authenticated port allows you to use IDM to dynamically configure
tagged and untagged VLANs as required for different client devices, such as
PCs and IP phones, that share the same switch port.

Additional RADIUS Attributes

The following attributes are included in Access-Request and Access-Account-
ing packets sent from the switch to the RADIUS server to advertise switch
capabilities, report information on authentication sessions, and dynamically
reconfigure authentication parameters:
■ MS-RAS-Vendor (RFC 2548): Allows HP switches to inform a Micro-
soft RADIUS server that the switches are from HP Networking. This
feature assists the RADIUS server in its network configuration.
■ HP-capability-advert: An HP proprietary RADIUS attribute that allows
a switch to advertise its current capabilities to the RADIUS server for
port-based (MAC, Web, or 802.1X) authentication; for example, HP
VSAs for port QoS, ingress rate-limiting, IDM filter rules, RFC 4675
QoS and VLAN attributes, and RFC 3580 VLAN-related attributes.
The RADIUS server uses this information to make a more intelligent policy
decision on the configuration settings to return to the switch for a client
session.
HP-acct-terminate-cause: An HP proprietary RADIUS accounting
■
attribute that allows a switch to report to the RADIUS server why an
authentication session was terminated. This information allows
customers to diagnose network operational problems and generate
reports on terminated sessions. This attribute provides extended
information on the statistics provided by the acct-terminate-cause
attribute.
■ Change-of-Authorization (CoA) (RFC 3576: Dynamic Authorization
Extensions to RADIUS): A mechanism that allows a RADIUS server
to dynamically disconnect messages (DM) or change the authoriza-
RADIUS Authentication, Authorization, and Accounting
VLAN Assignment in an Authentication Session
6-45