802.1X Open Vlan Operating Notes - HP Q.11.XX Manual

Configuring Port-Based and Client-Based Access Control (802.1X)
802.1X Open VLAN Mode
Configures the switch to look for a RADIUS server with an IP address of 10.28.127.101
and an encryption key of rad4all.
ProCurve(config)# aaa port-access authenticator e a10-a20 unauth-vid 80
Configures ports A10 - A20 to use VLAN 80 as the Unauthorized-Client VLAN.
ProCurve(config)# aaa port-access authenticator e a10-a20 auth-vid 81
Configures ports A10 - A20 to use VLAN 81 as the Authorized-Client VLAN.
ProCurve(config)# aaa port-access authenticator active
Activates 802.1X port-access on ports you have configured as authenticators.
8-38
Inspecting 802.1X Open VLAN Mode Operation. For information and
an example on viewing current Open VLAN mode operation, refer to "Viewing
802.1X Open VLAN Mode Status" on page 8-50.

802.1X Open VLAN Operating Notes

Although you can configure Open VLAN mode to use the same VLAN
■
for both the Unauthorized-Client VLAN and the Authorized-Client
VLAN, this is not recommended. Using the same VLAN for both
purposes allows unauthenticated clients access to a VLAN intended
only for authenticated clients, which poses a security breach.
While an Unauthorized-Client VLAN is in use on a port, the switch
■
temporarily removes the port from any other statically configured
VLAN for which that port is configured as a member. Note that the
Menu interface will still display the port's statically configured
VLAN(s).
■ A VLAN used as the Unauthorized-Client VLAN should not allow
access to resources that must be protected from unauthenticated
clients.
■ If a port is configured as a tagged member of VLAN "X" that is not used
as an Unauthorized-Client, Authorized-Client, or RADIUS-assigned
VLAN, then the port returns to tagged membership in VLAN "X" upon
successful client authentication. This happens even if the RADIUS
server assigns the port to another, authorized VLAN "Y". Note that if
RADIUS assigns VLAN "X" as an authorized VLAN, then the port
becomes an untagged member of VLAN "X" for the duration of the
client connection. After the client disconnects, the port returns to
tagged membership in VLAN "X". (If there is no Authorized-Client or