Mac-Based Vlans - HP 3500yl Series Access Security Manual

RADIUS Authentication, Authorization, and Accounting

MAC-Based VLANs

MAC-Based VLANs
MAC-Based VLANs (MBVs), available on the 5400 and 8200 version 2 interface
modules, allow multiple clients on a single switch port to receive different
untagged VLAN assignments. VLAN assignment of untagged traffic is based
on the source MAC address rather than the port. Clients receive their untagged
VLAN assignment from the RADIUS server. This feature adheres to the require-
ment that if all known IDM attributes for a given client cannot be applied the
authentication request for that client must be rejected.
Both authenticated and unauthenticated clients can reside on the same port
on different VLANs, but only if the mixed-mode configuration is enabled. This
is not the default behavior. The normal operating behavior is to not allow
unauthenticated clients on the port when at least one authenticated client is
present on the port. If an unauthenticated client is present on the unauth VLAN
and another client successfully authenticates on that port, the unauthenti-
cated client is kicked off the port.
When a MBV cannot be applied due to a conflict with another client on that
port a message indicating VID arbitration error is logged.
When a MBV cannot be applied due to lack of resources a message indicating
lack of resources is logged.
There is no command line support for this feature. The decision to use a MBV
is made automatically if the hardware is capable and if the situation necessi-
tates. If multiple clients authenticate on different untagged VLANs on hard-
ware that does not support MBVs, the switch will reject all clients authorized
on a VLAN different from the first client's VLAN - the first authenticated client
sets the Port VID (PVID).
This feature has the side effect of allowing egress traffic from one client's
VLAN to be accepted by all untagged clients on that port. For example,
suppose that clients A and B are both located on the same switch port, but on
two different VLANs. If client A is subscribing to a multicast stream, then client
B also receives that multicast traffic.
6-51