HP ProCurve 3500yl Release Notes page 48

Enhancements
Release K.12.05 Enhancements
Note
You can use 802.1X (port-based or client-based) authentication and either Web or MAC authentication
at the same time on a port, with a maximum of 32 clients allowed on the port. (The default is one
client.) Web authentication and MAC authentication are mutually exclusive on the same port. Also,
you must disable LACP on ports configured for any of these authentication methods. For more
information, refer to the "Configuring Port-Based and User-Based Access Control (802.1X)" and "Web
and MAC Authentication" chapters of the Access Security Guide.
VLAN Assignment on a ProCurve Port
Following client authentication, VLAN configurations on a ProCurve port are managed as follows
when you use 802.1X, MAC, or Web authentication:
■ The port resumes membership in any tagged VLANs for which it is already assigned in the
switch configuration. Tagged VLAN membership allows a port to be a member of multiple
VLANs simultaneously.
■ The port is temporarily assigned as a member of an untagged (static or dynamic) VLAN for
use during the client session according to the following order of options.
a. The port joins the VLAN to which it has been assigned by a RADIUS server during client
authentication.
b. If RADIUS authentication does not include assigning the port to a VLAN, then the switch
assigns the port to the authorized-client VLAN configured for the authentication method.
c. If the port does not have an authorized-client VLAN configured, but is configured for
membership in an untagged VLAN, the switch assigns the port to this untagged VLAN.
Operating Notes
■ During client authentication, a port assigned to a VLAN by a RADIUS server or an
authorized-client VLAN configuration is an untagged member of the VLAN for the duration
of the authenticated session. This applies even if the port is also configured in the switch as
a tagged member of the same VLAN. The following restrictions apply:
• If the port is assigned as a member of an untagged static VLAN, the VLAN must already
be configured on the switch. If the static VLAN configuration does not exist, the
authentication fails.
• If the port is assigned as a member of an untagged dynamic VLAN that was learned
through GVRP, the dynamic VLAN configuration must exist on the switch at the time of
authentication and GVRP-learned dynamic VLANs for port-access authentication must
be enabled
37