3Com 4500 PWR 26-Port Configuration Manual page 392

For a VLAN ID with suffix t or T, the authentication port sends the frames of the VLAN tagged.
For the first VLAN ID with suffix u or U, or with no suffix in the VLAN list, the authentication port
sends the frames of the VLAN untagged and configures the VLAN as its default VLAN; for the other
VLAN IDs with suffix u or U, or with no suffix, the authentication port still sends the frames of the
corresponding VLANs tagged.
That is, except the VLAN corresponding to the first VLAN ID with suffix u or U, or with no suffix in the
VLAN list, the authentication port sends the frames of all the VLANs specified in the VLAN list tagged.
Suppose the RADIUS server issues a VLAN list "1u 2t 3" to a switch. After the switch resolves the list, it
assigns the authentication port to VLAN 1, VLAN 2, and VLAN 3, configures VLAN 1 as the default
VLAN of the authentication port, and configures the authentication port to send frames of VLAN 1
untagged and send frames of VLAN 2 and VLAN 3 tagged.
According to the way a switch resolves a VLAN list, the resolution results of VLAN lists "1u 2u 3u", "1 2
3", "1 2t 3t", "2t 1u 3", "2t 1 3t", and "2t 1 3u" are all the same as that of "1u 2t 3".
Because the switch needs to assign a port to multiple VLANs specified in a VLAN list, only hybrid
and trunk ports support the Auto VLAN feature.
For a trunk port, the issued VLAN list must include a default VLAN ID, that is, the VLAN IDs in the
VLAN list cannot be all followed by suffix t or T.
A VLAN list issued by the RADIUS server can contain up to 64 VLAN IDs. Otherwise, the
authentication fails. In addition, a RADIUS attribute string can contain up to 253 characters. For a
VLAN list of more than 253 characters, even though the VLAN list contains no more than 64 VLAN
IDs, the authentication switch will not accept this VLAN list, which will also cause the authentication
to fail;
If a VLAN ID appears in a VLAN list more than once, the tag processing mode for the VLAN
depends on the suffix of the VLAN ID appearing the last time; According to this rule, if VLAN list "1u
2u 1t" or "1u 2u 1" is issued to a port, the port joins VLAN 1 and VLAN 2, sending frames of VLAN
1 and VLAN 2 tagged ,this VLAN list the same as "2t 1t";
The VLAN IDs in the VLAN list must be within the valid VLAN ID range; however, they are not
required to be sorted in an ascending or descending order;
A VLAN ID starting with 0 is considered illegal;
A Tunnel-Private-Group-ID string cannot include characters other than numbers, U, u, T, and t. For
example, 3.0 and -3 are illegal characters;
The number of spaces preceding and following a VLAN ID and its suffix is not restricted, but there
should be no space between a VLAN ID and its suffix. For example, the resolution results of VLAN
lists " 1u 2t 3", "1u 2t 3 ", "1u 2t 3", and "1u2t3" are all the same as that of "1u 2t 3", while VLAN
lists "1uu2t 3", "1 u 2t 3", and "u" are all illegal.
In actual applications, to use this feature together with Guest VLAN, you should better set port control to
port-based mode. For more information, refer to Basic 802.1x Configuration of 802.1x and System
Guard Operation.
Follow these steps to configure dynamic VLAN assignment:
33-7