Configuring An Auth-Fail Vlan - HP 830 Series Configuration Manual

If the 802.1X-enabled port performs MAC-based access control, configure the port as a hybrid port,
•
enable MAC-based VLAN on the port, and assign the port to the 802.1X guest VLAN as an
untagged member.
Configuration guidelines
• The 802.1X guest VLANs on different ports can be different.
Assign different IDs to the voice VLAN, the port VLAN, and the 802.1X guest VLAN on a port, so
•
the port can correctly process incoming VLAN tagged traffic.
• With 802.1X authentication, a hybrid port is always assigned to a VLAN as an untagged member.
After the assignment, do not reconfigure the port as a tagged member in the VLAN.
Use Table 101
•
Table 101 Relationships of the 802.1X guest VLAN and other security features
Feature
MAC authentication guest VLAN on a port that
performs MAC-based access control
802.1X Auth-Fail VLAN on a port that performs
MAC-based access control
Port intrusion protection on a port that performs
MAC-based access control

Configuring an Auth-Fail VLAN

Configuration prerequisites
• Create the VLAN to be specified as the 802.1X Auth-Fail VLAN.
If the 802.1X-enabled port performs port-based access control, enable 802.1X multicast trigger.
•
(802.1X multicast trigger is enabled by default.)
• If the 802.1X-enabled port performs MAC-based access control, configure the port as a hybrid port,
enable MAC-based VLAN on the port, and assign the port to the Auth-Fail VLAN as an untagged
member.
Configuration guidelines
The 802.1X Auth-Fail VLANs on different ports can be different.
•
• Assign different IDs to the voice VLAN, the port VLAN, and the 802.1X Auth-Fail VLAN on a port,
so the port can correctly process VLAN tagged incoming traffic.
Use Table 102
•
Table 102 Relationships of the 802.1X Auth-Fail VLAN with other features
Feature
MAC authentication guest VLAN on a port that
performs MAC-based access control
when you configure multiple security features on a port.
when you configure multiple security features on a port.
Relationship description
Only the 802.1X guest VLAN takes effect. A user who fails
MAC authentication will not be assigned to the MAC
authentication guest VLAN.
The 802.1X Auth-Fail VLAN has a high priority.
The 802.1X guest VLAN function has higher priority than
the block MAC action but lower priority than the shut
down port action of the port intrusion protection feature.
Relationship description
The 802.1X Auth-Fail VLAN has a high priority.
316