Mac Authentication; Authorized And Unauthorized Client Vlans - ProCurve 2900 Manual

Web and MAC Authentication
Overview
Note
Note
3-4
A proxy server is not supported for use by a browser on a client device that
accesses the network through a port configured for web authentication.
In the login page, a client enters a username and password, which the switch
forwards to a RADIUS server for authentication. After authenticating a client,
the switch grants access to the secured network. Besides a web browser, the
client needs no special supplicant software. The enhanced Web Authentica­
tion (EWA) feature allows you to provide customized web pages for client
login.

MAC Authentication

The MAC Authentication (MAC-Auth) method grants access to a secure
network by authenticating devices for access to the network. When a device
connects to the switch, either by direct link or through the network, the switch
forwards the device's MAC address to the RADIUS server for authentication.
The RADIUS server uses the device MAC address as the username and
password, and grants or denies network access in the same way that it does
for clients capable of interactive logons. (The process does not use either a
client device configuration or a logon session.) MAC authentication is well-
suited for clients that are not capable of providing interactive logons, such as
telephones, printers, and wireless access points. Also, because most RADIUS
servers allow for authentication to depend on the source switch and port
through which the client connects to the network, you can use MAC-Auth to
"lock" a particular device to a specific switch and port.
802.1X port-access and either Web authentication or MAC authentication can
be configured at the same time on the same port. A maximum of 32 clients is
supported on the port. (The default is one client.)
Web authentication, MAC authentication, MAC lockdown, MAC lockout, and
port-security are mutually exclusive on a given port. If you configure any of
these authentication methods on a port, you must disable LACP on the port.

Authorized and Unauthorized Client VLANs

Web-Auth and MAC-Auth provide a port-based solution in which a port
belongs to one, untagged VLAN at a time. The switch supports up to 32
simultaneous client sessions per port. All authenticated client sessions
operate in the same untagged VLAN. (If you want the switch to simultaneously