HP ProCurve 9304M Security Manual page 103

If one of the attributes in the Access-Accept message specifies a VLAN identifier, and this VLAN is available on
the HP device, the client's port is moved from its default VLAN to the specified VLAN. When the client disconnects
from the network, the port is placed back in its default VLAN.
NOTE: This feature is supported on port-based VLANs only. This feature cannot be used to place an 802.1X-
enabled port into a Layer 3 protocol VLAN.
To enable 802.1X VLAN ID support, you must add the following attributes to a user's profile on the RADIUS
server:
Attribute Name
Tunnel-Type
Tunnel-Medium-Type
Tunnel-Private-Group-ID
The device reads the attributes as follows:
• If the Tunnel-Type or the Tunnel-Medium-Type attributes in the Access-Accept message do not have the
values specified above, the HP device ignores the three Attribute-Value pairs. The client becomes
authorized, but the client's port is not dynamically placed in a VLAN.
• If the Tunnel-Type or the Tunnel-Medium-Type attributes in the Access-Accept message do have the values
specified above, but there is no value specified for the Tunnel-Private-Group-ID attribute, the client will not
become authorized.
• When the HP device receives the value specified for the Tunnel-Private-Group-ID attribute, it checks whether
the <vlan-name> string matches the name of a VLAN configured on the device. If there is a VLAN on the
device whose name matches the <vlan-name> string, then the client's port is placed in the VLAN whose ID
corresponds to the VLAN name.
• If the <vlan-name> string does not match the name of a VLAN, the HP device checks whether the string,
when converted to a number, matches the ID of a VLAN configured on the device. If it does, then the client's
port is placed in the VLAN with that ID.
• If the <vlan-name> string does not match either the name or the ID of a VLAN configured on the device, then
the client will not become authorized.
The show interface command displays the VLAN to which an 802.1X-enabled port has been dynamically
assigned, as well as the port from which it was moved (that is, the port's default VLAN). See "Displaying
Dynamically Assigned VLAN Information" on page 4-22 for sample output indicating the port's dynamically
assigned VLAN.
Using Dynamic VLAN Assignment with the MAC Port Security Feature
The MAC port security feature can be configured on 802.1X-enabled ports. The MAC port security feature allows
the HP device to learn a limited number of "secure" MAC addresses on an interface. The interface will forward only
packets with source MAC addresses that match these secure addresses. If the interface receives a packet with a
source MAC address that is different from any of the secure addresses, it is considered a security violation, and
subsequent packets from the violating MAC address can be dropped, or the port can be disabled entirely.
If a port has been disabled due to a MAC port security violation, 802.1X clients attempting to connect over the port
cannot be authorized. In addition, 802.1X clients connecting from non-secure MAC addresses cannot be
authorized.
To use 802.1X dynamic VLAN assignment with the MAC port security feature on an interface, you must set the
number of secure MAC addresses to two or more. For example:
ProCurveRS(config)# int e 3/2
June 2005
Type Value
064 13 (decimal) – VLAN
065 6 (decimal) – 802
081 <vlan-name> (string) – either the name or the
number of a VLAN configured on the HP device.
Configuring 802.1X Port Security
4 - 17