HP 4100gl manual Port as a static, tagged member of the VLAN, membership

Configuring Port-Based Access Control (802.1x)

802.1x Open VLAN Mode

Table 6-1. 802.1x Open VLAN Mode Options

802.1x Per-Port Configuration	Port Response
No Open VLAN mode:	The port automatically blocks a client that cannot initiate an
	authentication session.

Open VLAN mode with both of the following configured:

Unauthorized-Client VLAN	• When the port detects a client, it automatically becomes an
	untagged member of this VLAN. If you previously configured the
	port as a static, tagged member of the VLAN, membership
	temporarily changes to untagged while the client remains
	unauthenticated.
	• If the port already has a statically configured, untagged
	membership in another VLAN, then the port temporarily closes
	access to this other VLAN while in the Unauthorized-Client VLAN.
	• To limit security risks, the network services and access available
	on the Unauthorized-Client VLAN should include only what a client
	needs to enable an authentication session. If the port is statically
	configured as a tagged member of any other VLANs, access to
	these VLANs remains open, even though the client may not be
	authenticated. Refer to the Caution on page page 6-21.
Authorized-Client VLAN	• After the client is authenticated, the port drops membership in the
	Unauthorized-Client VLAN and becomes an untagged member of
	this VLAN.
	Note: if RADIUS authentication assigns a VLAN, the port
	temporarily becomes a member of the RADIUS-assigned VLAN —
	instead of the Authorized-Client VLAN—while the client is
	connected.
	• If the port is statically configured as a tagged member of a VLAN,
	and this VLAN is used as the Authorized-Client VLAN, then the port
	temporarily becomes an untagged member of this VLAN when the
	client becomes authenticated. When the client disconnects, the
	port returns to tagged membership in this VLAN.
	• If the port is statically configured as a tagged member of a VLAN
	that is not used by 802.1x Open VLAN mode, an unauthenticated
	client capable of operating in tagged VLANs has access to this
	VLAN. Refer to the Caution on page page 6-21.

6-22