3Com 4500 PWR 26-Port Configuration Manual page 182

Security modes with the Else keyword
macAddressElseUserLoginSecure: As the Else keyword implies, MAC authentication is applied
first. A port in this mode performs only MAC authentication for non-802.1X frames; it performs MAC
authentication for 802.1X frames and then, if the authentication fails, 802.1X authentication. The
port in this mode supports only one 802.1X online user, but supports multiple MAC authenticated
online users.
macAddressElseUserLoginSecureExt: Similar to the macAddressElseUserLoginSecure
mode except that the port in this mode services multiple 802.1X online users as the Ext keyword
implies
.
Figure 15-3 shows how the port processes packets in a security mode with the Else keyword.
Figure 15-3 Packet processing in security modes with the Else keyword
No
Fail
Drop the packet
Security mode with the Or keyword
macAddressOrUserLoginSecure: A port in this mode performs MAC authentication upon
receiving non-802.1X frames and performs 802.1X authentication upon receiving 802.1X frames.
802.1X authentication can be applied to users who have already passed MAC authentication. The
port in this mode supports up to one 802.1X online user, but supports multiple MAC authenticated
online users.
macAddressOrUserLoginSecureExt: Similar to the macAddressOrUserLoginSecure mode
except that a port in this mode supports multiple 802.1X online users.
Figure 15-4 shows how the port processes packets in a security mode with the Or keyword.
The port in a security
mode with Else receives
a packet
Is the source
MAC in the MAC
address table?
No
Perform MAC
authentication
Fail
Is it an 802.1X packet?
Yes
Perform 802.1X
authentication
15-5
Yes
Forward the packet
Succeed
Succeed
Allow access to
authorized resources