Configuration Prerequisites; Configuration Procedure - HP 3600 v2 Series Configuration Manual

Table 8 Relationships of the 802.1X guest VLAN and other security features
Feature
Super VLAN
MAC authentication guest VLAN
on a port that performs
MAC-based access control
802.1X Auth-Fail VLAN on a port
that performs MAC-based access
control
Port intrusion protection on a port
that performs MAC-based access
control

Configuration prerequisites

• Create the VLAN to be specified as the 802.1X guest VLAN.
If the 802.1X-enabled port performs port-based access control, enable 802.1X multicast trigger
•
(dot1x multicast-trigger).
If the 802.1X-enabled port performs MAC-based access control, configure the port as a hybrid port,
•
enable MAC-based VLAN on the port, and assign the port to the 802.1X guest VLAN as an
untagged member. For more information about the MAC-based VLAN function, see Layer 2
Switching Configuration Guide.

Configuration procedure

To configure an 802.1X guest VLAN:
Step
1. Enter system view.
2. Configure an 802.1X
guest VLAN for one
or more ports.
Relationship description
You cannot specify a VLAN as both a super
VLAN and an 802.1X guest VLAN.
Only the 802.1X guest VLAN take effect. A
user that fails MAC authentication will not
be assigned to the MAC authentication
guest VLAN.
The 802.1X Auth-Fail VLAN has a higher
priority
The 802.1X guest VLAN function has
higher priority than the block MAC action
but lower priority than the shut down port
action of the port intrusion protection
feature.
Command
system-view
•
In system view:
dot1x guest-vlan guest-vlan-id [ interface
interface-list ]
•
In Ethernet interface view:
a. interface interface-type interface-number
b. dot1x guest-vlan guest-vlan-id
90
Reference
See Layer 2 LAN
—
Switching Configuration
Guide
See "Configuring MAC
authentication"
See "Using 802.1X
authentication with other
features"
See "Configuring port
security"
—
Remarks
N/A
Use either method.
By default, no 802.1X guest
VLAN is configured on any
port.
LAN