MAC-based VLANs in the ProCurve

In the ProCurve normally only one untagged VLAN is allowed on each switch port. Here’s the reason:

The VLAN ID is carried in the VLAN tag of the Layer 2 (Ethernet) frame, so as long as there’s a VLAN tag in the frame header we can tell which frame is associated with which VLAN. On the other hand in an untagged frame there is no VLAN tag, so there’s no way to tell directly from the frame header which VLAN the frame is associated with. However on a specific port we can always associate that “frame with no tag” with one single VLAN, and we do that by switch configuration. For example:

vlan 3
    name "VLAN3"
    untagged A1
    no ip address
    exit

From the above configuration we know that on port A1, an untagged frame is associated with VLAN 3. All untagged frames at all ports are associated with VLAN 1 by default, unless they are explicitly configured otherwise like in the above example.

Now, MAC-based VLANs (MBVs) use the source MAC address of an untagged frame as the basis for VLAN assignment. Therefore an untagged frame is no longer bound to a single configured VLAN. In this case each switch port can support untagged frames that belong to more than one VLANs.

In the ProCurve, MAC-based VLANs are not configurable, i.e. there is no command to enable or disable or modify it. This feature is used mostly for an authentication server such as RADIUS to allow multiple clients on the same switch port to receive different untagged VLAN assignments. The VLAN assignment for each client is done by the authentication server according to the configured server policy; and in case different untagged VLANs are assigned to clients attached to the same switch port, MBVs will automatically kick in.

A side-effect of this feature is that it allows egress traffic from one client’s VLAN to reach all untagged clients on the same port even though these other clients might not be in the same VLAN. For example, suppose clients A and B are both attached to the same switch port but untagged for different VLANs. Then if A is subscribing to a multicast stream then B will receive the same multicast stream as well.

An important point to remember is that MBVs are not supported on V1 hardware. They are only available on V2 or later hardware. When a situation arises where 2 clients are assigned different untagged VLANs on the same switch port and the switch hardware does not support MBVs, warnings about “untagged VLAN-id arbitration error” will appear in the event log.

Below is an interesting case study:

Two clients, an IP phone and a PC, were connected to the same switch port which was configured to do both MAC-based and 802.1X authentication. The RADIUS server policy was that once authenticated the phone should be assigned to VLAN 5 as tagged, while the PC should be assigned to VLAN 2 as untagged.

The problem was that there was always one client that failed authentication and was dropped from the switch port. In some cases the phone failed, in some other cases the PC failed. In the event log there were warnings such as:

W 07/14/17 09:35:48 02402 dca: macAuth client untagged VLAN-id arbitration error, MAC ………… port A1
W 07/13/17 08:02:27 02402 dca: 8021X client untagged VLAN-id arbitration error, MAC ………… port B2

What added to the puzzle was that out of 5 switches of the same model, 3 switches saw the issue while the other 2 did not.

Here’s what happened:

- The RADIUS server policy was misconfigured, instead of the phone to be put into VLAN 5 as tagged it was configured for VLAN 5 as untagged. This led to a situation where 2 clients were assigned to 2 different untagged VLANs on the same switch port. This was where MBV kicked in.

- However the MBV feature was available only on V2 hardware and later. So for switches that had V2 hardware there was no issue. The switches that had issues were the V1 switches

ProCurve Switches - Illegitimate 802.1x Clients Get past RADIUS via Backup Authentication Method

The symptom is that illegitimate 802.1x clients gain access to the VLANs they are not supposed to be in even though RADIUS authentication is configured.

This is a configuration error that might have easily escaped attention: the backup authentication method is configured as "authorized", which means to allow access without authentication, as seen in the following command:

# aaa authentication port-access eap-radius authorized

If for some reason RADIUS service becomes unavailable, the backup authentication method will kick in, and in this case will allow access with no authentication.

To fix this problem, instead of specifying the backup authentication method as "authorized", use "none" (which means no backup method is used) as follows:

# aaa authentication port-access eap-radius none

Local MAC Authentication in HP ProCurve Switches (K/KA.15.14)

Local MAC Authentication (LMA) locally performs MAC address-based authentication (as opposed to MAC authentication using a RADIUS server). Based on this authentication, devices can be assigned to appropriate VLANs and, optionally, CoS values. The usage of MAC OUI and MAC mask allows to group multiple devices under one single policy.

Configuring LMA using MAC groups:

Creating MAC groups and assign MAC addresses to each group. In the following example:

The first MAC group (“admin-pc-grp”) is assigned one single MAC address.
The second MAC group (“corp-pcs-grp”) is assigned 2 groups of addresses, each group is determined by the first 32 bits in the addresses.
The third MAC group (“corp-phones-grp”) is assigned all addresses carrying the same 24-bit OUI part of the MAC addresses.

HP-5406zl(config)# aaa port-access local-mac mac-group “admin-pc-grp” mac-addr 005056840161
HP-5406zl(config)# aaa port-access local-mac mac-group “corp-pcs-grp” mac-mask 002622bb/32 002622bc/32
HP-5406zl(config)# aaa port-access local-mac mac-group “corp-phones-grp” mac-oui 008011

Creating LMA profiles. In each profile, attributes such as VLAN (tagged or untagged) and QoS setting (CoS priority, aka 802.1p value) can be assigned.

HP-5406zl(config)# aaa port-access local-mac profile “admin-pc-prof” vlan untagged 2 cos 5
HP-5406zl(config)# aaa port-access local-mac profile “corp-pcs-prof” vlan untagged 3
HP-5406zl(config)# aaa port-access local-mac profile “corp-phones-prof” vlan tagged 5 cos 6

Linking profiles to MAC groups:

HP-5406zl(config)# aaa port-access local mac apply profile admin-pc-prof mac-group admin-pc-grp
HP-5406zl(config)# aaa port-access local mac apply profile corp-pcs-prof mac-group corp-pcs-grp
HP-5406zl(config)# aaa port-access local mac apply profile corp-phones-prof mac-group corp-phones-grp

Enabling LMA on ports:

HP-5406zl(config)# aaa port-access local-mac a1

Configuring LMA without MAC groups:

Creating LMA profiles just like in the previous section (using MAC groups). Again, in each profile attributes such as VLAN (tagged or untagged) and QoS setting (CoS priority, aka 802.1p value) can be assigned.

HP-5406zl(config)# aaa port-access local-mac profile “admin-pc-prof” vlan untagged 2 cos 5
HP-5406zl(config)# aaa port-access local-mac profile “corp-pcs-prof” vlan untagged 3
HP-5406zl(config)# aaa port-access local-mac profile “corp-phones-prof” vlan tagged 5 cos 6

Linking MAC addresses directly to profiles:

HP-5406zl(config)# aaa port-access local mac apply profile admin-pc-prof mac-addr 005056840161
HP-5406zl(config)# aaa port-access local mac apply profile corp-pcs-prof mac-mask 002622bb/32
HP-5406zl(config)# aaa port-access local mac apply profile corp-pcs-prof mac-mask 002622bc/32
HP-5406zl(config)# aaa port-access local mac apply profile corp-phones-prof mac-oui 008011

Enabling LMA on ports:

HP-5406zl(config)# aaa port-access local-mac a1

Question: What is the difference between LMA configuration using MAC groups and not using MAC groups?
Answer: LMA configuration not using MAC groups is a shortcut, useful when one has just a few MAC addresses for the same profile. When there is a lot of MAC addresses to be put under the same profile, MAC groups are recommended to avoid confusion.

LMA Monitoring:

After the LMA configuration shown above, when the client with the MAC address of 005056840161 accesses the switch at the specified port, it will be granted access. For monitoring LMA, enter the following command:

HP-5406zl(config)# show port-access local-mac active

The output will look like below. Notice that the authenticated client was put into VLAN 2 as untagged with CoS priority value of 5, just like what has been configured in the profile associated with that MAC address.

Other Features:

- The default MAC address format is “no delimiter”, for example "002622bba7ac" as shown in previous examples. To change the MAC address format, use the command:

HP-5406zl(config)# aaa port-access mac-based addr-format

MAC address format options include: no-delimiter (default), single-dash, multi-dash, multi-colon, no-delimiter-uppercase, single-dash-uppercase, multi-dash-uppercase, multi-colon-uppercase.

- By default, clients that cannot be authenticated will be dropped. However, an unauthenticated VLAN can be configured for these clients to access limited services. The administrator must implement measures to isolate the unauthenticated VLAN from restricted resources.

HP-5406zl(config)# aaa port-access local-mac unauth-vid 99

- On the other hand, if a client is successfully authenticated yet does not have a VLAN assignment in its profile, then it will be moved to an authorized VLAN which can be configured as below:

HP-5406zl(config)# aaa port-access local-mac auth-vid 10

- There are also a number of per-port parameters such as addr-limit (maximum number of authenticated local MAC addresses), logoff-period (period of time of inactivity that the switch considers an implicit logoff), quiet-period (period of time the switch does not try to authenticate), unauth-period (period of time the switch waits before moving the port to the VLAN for unauthenticated clients), which can be changed from their default values. For example:

HP-5406zl(config)# aaa port-access local-mac unauth-period 320

- When multiple authentication methods are configured concurrently on a single port, the order of precedence is: 802.1X, LMA, and Web Authentication / MAC Authentication.