H3C Technologies H3C S10500 Series Switches - Manual (Page 137)

126
NOTE:
•
When a port is assigned to the corresponding VLAN in a MAC address-to-VLAN entry, but has not
been assigned to the VLAN by using the port hybrid vlan command, the port sends packets from the
VLAN with VLAN tags removed.
• If you configure both static and dynamic MAC-based VLAN assignment on the same port, dynamic
MAC-based VLAN assignment applies.
• A port forwards frames matching MAC-to-VLAN entries according to the 802.1p priorities of the
MAC-based VLANs.
Dynamic MAC-based VLAN
You can use dynamic MAC-based VLAN with access authentication (such as 802.1X authentication
based on MAC addresses) to implement secure, flexible terminal access. After configuring dynamic
MAC-based VLAN on the device, you must configure the username-to-VLAN entries on the access
authentication server.
When a user passes authentication of the access authentication server, the device obtains VLAN
information from the server, generates a MAC address-to-VLAN entry by using the source MAC address
of the user packet and the VLAN information, and assigns the port to the MAC-based VLAN. When the
user goes offline, the device automatically deletes the MAC address-to-VLAN entry, and removes the port
from the MAC-based VLAN.
NOTE:
For more information about 802.1X, MAC, and portal authentication, see Security Configuration Guide.
Configuring a MAC-based VLAN
NOTE:
•
MAC-based VLANs are available only on hybrid ports.
• You cannot configure super VLANs in the MAC address-to-VLAN entries.
• With dynamic MAC-based VLAN assignment enabled, packets are delivered to the CPU for processing.
The packet processing mode has the highest priority and overrides the configuration of MAC learning
limit and disabling of MAC address learning. When dynamic MAC-based VLAN assignment is
enabled, do not configure the MAC learning limit or disable MAC address learning.
• Do not use dynamic MAC-based VLAN assignment together with 802.X and MAC authentication.
• In dynamic MAC-based VLAN assignment, the port that receives a packet with an unknown source
MAC address can be successfully assigned to the matched VLAN only when the matched VLAN is a
static VLAN.
• The MAC-based VLAN feature is mainly configured on the downlink ports of the user access devices. Do
not enable this function together with link aggregation.
• With MSTP enabled, if a port is blocked in the MST instance (MSTI) of the target MAC-based VLAN, the
port drops the received packets, instead of delivering them to the CPU. As a result, the receiving port will
not be dynamically assigned to the corresponding VLAN. Do not configure dynamic MAC-based VLAN
assignment together with MSTP, because the former is mainly configured on the access side.
Follow these steps to configure static MAC-based VLAN assignment: