Users And Vlans - 3Com 3CRWX120695A Reference Manual

Users and VLANs

You must assign the system IP address to one of the VLANs, to allow
communications between WX switches and for unsolicited
communications such as SNMP traps and RADIUS accounting messages.
Any IP address configured on a WX switch can be used for management
access unless explicitly restricted.
When a user successfully authenticates to the network, the user is
assigned to a specific VLAN. A user remains associated with the same
VLAN throughout the user's session on the network, even when roaming
from one WX switch to another within the Mobility Domain.
You assign a user to a VLAN by setting one of the following attributes on
the RADIUS servers or in the local WX user database:
Tunnel-Private-Group-ID — This attribute is described in RFC 2868,
RADIUS Attributes for Tunnel Protocol Support.
VLAN-Name — This attribute is a 3Com vendor-specific attribute
(VSA).
You cannot configure the Tunnel-Private-Group-ID attribute in the local
user database.
Specify the VLAN name, not the number. If both attributes are used, the
WX uses the VLAN name in the VLAN-Name attribute.
VLAN Names
To create a VLAN, you must assign a name to it. VLAN names must be
globally unique across a Mobility Domain to ensure the intended user
connectivity as determined through authentication and authorization.
Every VLAN on a WX has a VLAN name, used for authorization purposes,
and a VLAN number. VLAN numbers can vary uniquely for each WX and
are not related to 802.1Q tag values even when used.
You cannot use a number as the first character in a VLAN name.
Roaming and VLANs
WX switches in a Mobility Domain contain a user's traffic within the VLAN
the user is assigned to. For example, if you assign a user to VLAN red, the
WX switches in the Mobility Domain contain the user's traffic within
VLAN red configured on the WX switches.
Configuring VLANs 189