H3C WA Series Configuration Manual

Also see for WA Series: Getting started guide Configuration guide Layer 2 command reference Command reference Command reference

Contents

H3C WA Series Configuration Manual Manual pdf 72 page image

8-9MAC-based VLAN implementationWith MAC-based VLAN configured, the AP processes received packets as follows:z When receiving an untagged frame, the AP looks up the list of MAC-to-VLAN mappings based onthe source MAC address of the frame for a match. Two matching modes are available: exactmatching and fuzzy matching. In exact matching mode, the AP searches the MAC-to-VLANmappings whose masks are all-Fs. If the MAC address in a MAC-to-VLAN mapping matches thesource MAC address of the untagged frame exactly, the AP ends the search and adds a VLAN tagcontaining the corresponding VLAN ID to the packet. In fuzzy matching mode, the AP searches theMAC-to-VLAN mappings whose masks are not all-Fs and performs a logical AND operation on thekeyword and each mask. If the result of an AND operation matches the corresponding MACaddress exactly, the AP ends the search the adds a VLAN tag containing the corresponding VLANID to the packet. If no match is found, the system looks up other types of VLANs to make theforwarding decision.z When receiving a tagged frame, the receiving port forwards the frame if it is assigned to thecorresponding VLAN or drops the frame if it is not. In this case, port-based VLAN applied.Approaches to creating MAC address-to-VLAN mappingsIn addition to creating MAC address-to-VLAN mappings at the CLI, you can use an authenticationserver to automatically issue MAC address-to-VLAN mappings.z Manually Static configuration (through CLI)You can associate MAC addresses with VLANs by using related commands.z Automatic configuration through the authentication server (that is, VLAN issuing)The AP associates MAC addresses with VLANs dynamically based on the information provided by theauthentication server. If a user goes offline, the corresponding MAC address-to-VLAN association isremoved automatically. Automatic configuration requires MAC address-to–VLAN mapping beconfigured on the authentication server. For more information, see 802.1X in the Security ConfigurationGuide.The two configuration approaches can be used at the same time, that is, you can configure a MACaddress-to-VLAN entry on both the local AP and the authentication server at the same time. Note thatthe MAC address-to-VLAN entry configuration takes effect only when the configuration on the local APis consistent with that on the authentication server. Otherwise, the previous configuration takes effect.Configuring a MAC Address-Based VLANMAC-based VLANs are available only on hybrid ports.Follow these steps to configure a MAC-based VLAN:To do... Use the command... RemarksEnter system view system-view —