ProCurve 2610 Manual page 384

Configuring Port-Based and User-Based Access Control (802.1X)
How RADIUS/802.1X Authentication Affects VLAN Operation
11-60
If the dynamic VLAN does not exist or if you have not enabled the use
of a dynamic VLAN for authentication sessions on the switch, the
authentication fails.
■ To enable the use of a GVRP-learned (dynamic) VLAN as the untagged
VLAN used in an authentication session, enter the aaa port-access gvrp­
vlans command, as described in "Enabling the Use of GVRP-Learned
Dynamic VLANs in Authentication Sessions" on page 11-64.
Enabling the use of dynamic VLANs in an authentication session offers
■
the following benefits:
• You avoid the need of having static VLANs pre-configured on the
switch.
• You can centralize the administration of user accounts (including user
VLAN IDs) on a RADIUS server.
For information on how to enable the switch to dynamically create
802.1Q-compliant VLANs on links to other devices using the GARP VLAN
Registration Protocol (GVRP), see "GVRP" on page 3-1 in the Advanced
Traffic Management Guide.
For an authentication session to proceed, a port must be an untagged
■
member of the (static or dynamic) VLAN assigned by the RADIUS server
(or an authorized-client VLAN configuration). The port temporarily drops
any current untagged VLAN membership.
If the port is not already a member of the RADIUS-assigned (static or
dynamic) untagged VLAN, the switch temporarily reassigns the port as an
untagged member of the required VLAN (for the duration of the session).
At the same time, if the port is already configured as an untagged
member of a different VLAN, the port loses access to the other VLAN for
the duration of the session. (A port can be an untagged member of only
one VLAN at a time.)
When the authentication session ends, the switch removes the temporary
untagged VLAN assignment and re-activates the temporarily disabled,
untagged VLAN assignment.
If GVRP is already enabled on the switch, the temporary untagged (static
■
or dynamic) VLAN created on the port for the authentication session is
advertised as an existing VLAN.
If this temporary VLAN assignment causes the switch to disable a different
untagged static or dynamic VLAN configured on the port (as described in
the preceding bullet and in "Example of Untagged VLAN Assignment in a
RADIUS-Based Authentication Session" on page 11-61), the disabled
VLAN assignment is not advertised. When the authentication session
ends, the switch: