Option For Authenticator Ports: Configure Port-Security To Allow Only 802.1X-Authenticated Devices - HP 3500yl Series Access Security Manual

Configuring Port-Based and User-Based Access Control (802.1X)

Option For Authenticator Ports: Configure Port-Security To Allow Only 802.1X-Authenticated Devices

13-48
During an authentication session on a port in 802.1X Open VLAN mode,
■
if RADIUS specifies membership in an untagged VLAN, this assignment
overrides port membership in the Authorized-Client VLAN. If there is no
Authorized-Client VLAN configured, then the RADIUS assignment over-
rides any untagged VLAN for which the port is statically configured.
■ If the only authenticated client on a port loses authentication during a
session in 802.1X Open VLAN mode, the port VLAN membership reverts
back to the Unauthorized-Client VLAN. If there is no Unauthorized-Client
VLAN configured, then the client loses access to the port until it can
reauthenticate itself. If there are multiple clients authenticated on the
port, if one client loses access and attempts to re-authenticate, that client
will be handled as a new client on the port.
■ The first client to authenticate on a port configured to support multiple
clients will determine the port's VLAN membership for any subsequent
clients that authenticate while an active session is already in effect.
Option For Authenticator Ports:
Configure Port-Security
To Allow Only 802.1X-Authenticated
Devices
If 802.1X authentication is disabled on a port or set to authorized (Force
Authorize), the port can allow access to a non-authenticated client. Port-
Security operates with 802.1X authentication only if the selected ports are
configured as 802.1X with the control mode in the port-access authenticator
command set to auto (the default setting). For example, if port A10 was at a
non-default 802.1X setting and you wanted to configure it to support the port-
security option, you would use the following aaa port-access command: