HP 5120 EI Switch Series User Manual

82
Configuring an 802.1X guest VLAN
Configuration guidelines
Follow these guidelines when configuring an 802.1X guest VLAN:
 You can configure only one 802.1X guest VLAN on a port. The 802.1X guest VLANs on different
ports can be different.
 Assign different IDs for the voice VLAN, the default VLAN, and the 802.1X guest VLAN on a port, so
the port can correctly process incoming VLAN tagged traffic.
 With 802.1X authentication, a hybrid port is always assigned to a VLAN as an untagged member.
After the assignment, do not re-configure the port as a tagged member in the VLAN.
 Use Table 6 when configuring multiple security features on a port.
Table 6 Relationships of the 802.1X guest VLAN and other security features
Feature
Relationship description
Reference
MAC authentication guest VLAN
on a port that performs MAC-
based access control
Only the 802.1X guest VLAN take effect.
A user that fails MAC authentication is not
assigned to the MAC authentication guest
VLAN.
The chapter ―MAC
authentication
configuration‖
802.1X Auth-Fail VLAN on a port
that performs MAC-based access
control
The 802.1X Auth-Fail VLAN has a higher
priority
The chapter ―802.1X
configuration‖
Port intrusion protection on a port
that performs MAC-based access
control
The 802.1X guest VLAN function has
higher priority than the block MAC action
but lower priority than the shut down port
action of the port intrusion protection
feature.
The chapter ―Port security
configuration‖
Configuration prerequisites
 Create the VLAN to be specified as the 802.1X guest VLAN.
 If the 802.1X-enabled port performs port-based access control, enable 802.1X multicast trigger.
 If the 802.1X-enabled port performs MAC-based access control, configure the port as a hybrid port,
enable MAC-based VLAN on the port, and assign the port to the 802.1X guest VLAN as an
untagged member. For more information about the MAC-based VLAN function, see the Layer 2 —
LAN Switching Configuration Guide.
Configuration procedure
Follow these steps to configure an 802.1X guest VLAN:
To do…
Use the command…
Remarks
Enter system view
system-view
—
Configure an
802.1X guest
VLAN for one
or more ports
In system view
dot1x guest-vlan guest-vlan-id [
interface interface-list ]
Required
Use either approach.
By default, no 802.1X guest
VLAN is configured on any port.
In Layer 2
Ethernet
interface interface-type interface-
number

HP 5120 EI Switch Series Specifications

General

Brand	HP
Model	5120 EI Switch Series
Category	Switch
Language	English