Dynamic port access auth via RADIUS

This feature allows a common port policy to be configured on all access ports by creating new RADIUS HP VSAs that will dynamically override the authentication limits. The changes are always applied to the port on the authenticator switch associated with the supplicant being authenticated.

	NOTE: All the changes requested by the VSAs must be valid for the switch configuration. For example, if either MAC-based or Web-based port access is configured while 802.1X port access is in client mode, a RADIUS client with a VSA to change the 802.1X port access to port-based mode is not allowed. 802.1X in port-based mode is not allowed with MAC-based or web-based port access types. However, if the authenticating client has VSAs to disable MAC-based and Web-based authentication in conjunction with changing 802.1X to portbased mode, then client authentication is allowed.

Only RADIUS-authenticated port-access clients will be able to dynamically change the port access settings using the new proprietary RADIUS VSAs. The settings that can be overridden are:

If the VSA client limit decreases the switch configured client limit, all clients except the client that is overriding the settings is deauthenticated. Only one client session at a time can override the port-access settings on a port. When the client session is deauthenticated, the port resets itself to the configured settings. This port reset causes the deauthentication of all clients for the port-access authentication types that had their settings changed dynamically.

The new VSAs are:

	NOTE: The changing of the client limits for a port using VSAs is temporary. The running configuration file is not changed and still displays the client limit and address limit settings.

Each authentication type may have a unique value for the client limit. If the value of the VSA is zero, the authentication type corresponding to that VSA will be disabled.

Settings for these VSAs are in effect for the duration of the authenticated session of the downstream supplicant switch. If for any reason there is a loss of the session (link loss between authenticator switch and supplicant switch, or authentication failure during reauthentication), the originally configured 802.1X and MAC authentication limits are restored.

The show port-access summary command displays the dynamically changed client limit settings.

Syntax:

	NOTE: If the command no aaa port-access authentication <port-list> client-limit is executed, the port access is in port-mode. If the 802.1X client-limit is configured with a value from 1-32, the port access is in user-mode.

HP Switch(config)# show port-access summary

 Port Access Status Summary

  Port-access authenticator activated [No] : No
  Allow RADIUS-assigned dynamic (GVRP) VLANs [No] : No

  Note: * indicates values dynamically overridden by RADIUS

           Authenticator         Web Auth        MAC Auth
  Port   Enabled Mode Limit   Enabled Limit   Enabled Limit
  ---- + ------- ---- ----- + ------- ----- + ------- -----
  1    | Yes     user*  1*  |  Yes     1    |  Yes     1
  2    | Yes     user  32   |  Yes    32*   |  Yes    32
  3    | Yes     port   1   |  No      1    |  No      1
  4    | No      port   1   |  No      1    |  No*     1

To display the configuration information for just those ports that are dynamically overridden by RADIUS attributes, use the show port-access summary radius-overridden command.

HP Switch(config)# show port-access summary radius-overridden

 Port Access Status Summary

  Port-access authenticator activated [No} : No
  Allow RADIUS-assigned dynamic (GVRP) VLANs [No] : No

  Note: * indicates values dynamically overridden by RADIUS

          Authenticator         Web Auth        MAC Auth
  Port   Enabled Mode Limit   Enabled Limit   Enabled Limit
  ---- + ------- ---- ----- + ------- ----- + ------- -----
  1    | Yes     user*  1*  | Yes       1   | Yes     1
  2    | Yes     user  32   | Yes      32*  | Yes    32
  4    | No      port   1   | No        1   | No*     1