R3303-HP HSR6800 Routers Security Configuration Guide

ManualsBrandsHP ManualsNetwork HardwareHP HSR68xx Configure-to-Order Router Solution

101

102

103

104

105

106

107

108

109

110

If no critical VLAN is configured, RADIUS server unreachable can cause an online user being

re-authenticated to be logged off. If a critical VLAN is configured, the user remains online and in the

original VLAN.

Configuring an 802.1X guest VLAN

Follow these guidelines when you configure an 802.1X guest VLAN:

• You can configure only one 802.1X guest VLAN on a port. The 802.1X guest VLANs on different

ports can be different.

• Assign different IDs to the voice VLAN, the port VLAN, and the 802.1X guest VLAN on a port, so

the port can correctly process incoming VLAN tagged traffic.

• You cannot specify a VLAN as both a super VLAN and an 802.1X guest VLAN. For more

information about super VLAN, see Layer 2—LAN Switching Configuration Guide.

Before configuring an 802.1X guest VLAN, complete the following tasks:

• Create the VLAN to be specified as the 802.1X guest VLAN.

• Enable 802.1X multicast trigger on the 802.1X-enabled port performs port-based access control.

To configure an 802.1X guest VLAN:

Ste

Command

Remarks

1. Enter system view.

system-view N/A

2. Configure an 802.1X

guest VLAN for one or

more ports in system

view or Ethernet

interface view.

• In system view:

dot1x guest-vlan guest-vlan-id [ interface

interface-list ]

• In Ethernet interface view:

a. interface interface-type

interface-number

b. dot1x guest-vlan guest-vlan-id

By default, no 802.1X guest

VLAN is configured on any

port.

Configuring an Auth-Fail VLAN

Follow these guidelines when configuring an 802.1X Auth-Fail VLAN:

• Assign different IDs to the port VLAN and the 802.1X Auth-Fail VLAN on a port, so the port can

correctly process VLAN tagged incoming traffic.

• You can configure only one 802.1X Auth-Fail VLAN on a port. The 802.1X Auth-Fail VLANs on

different ports can be different.

• Use Table 7 w

hen configuring multiple security features on a port.

Table 7 Relationships of the 802.1X Auth-Fail VLAN with other features

Feature Relationshi

descri

tion

Reference

Super VLAN

You cannot specify a VLAN as both a super

VLAN and an 802.1X Auth-Fail VLAN.

See Layer 2—LAN Switching

Configuration Guide.