Alaxala AX1250S Series User manual

AX1240S-AP-0202C_R2X
A
AX X1 12 25 50 0S S
A
AX X1 12 24 40 0S S
Software Manual Corrections
(For Ver. 2.2.C/2.2.D/2.2.E)
Released September 2010 (Edition 3)

AX1240S-AP-0202C_R2X
2
Preface
This document contains corrections for the AX1250S/AX1240S series software manuals (Copyright (c) 2008, 2010
ALAXALA Networks Corporation. All rights reserved.). When you read a manual listed in the following table, please
also read this document. The table below lists the AX1250S/AX1240S series software manuals to which the corrections in
this document apply.
Item No. Manual Name Manual Number Edition history
1 AX1250S / AX1240S Software Manual
Configuration Guide Vol. 1 (for Ver. 2.2) AX1240S-S001-30X January 2010
2 AX1250S / AX1240S Software Manual
Configuration Guide Vol. 2 (for Ver. 2.2) AX1240S-S002-40X January 2010
3 AX1250S / AX1240S Software Manual
Configuration Command Reference (for Ver. 2.2) AX1240S-S003-30X January 2010
4 AX1250S / AX1240S Software Manual
Operation Command Reference (for Ver. 2.2) AX1240S-S004-30X January 2010
5 AX1250S / AX1240S Software Manual
Message Log Reference (for Ver. 2.2) AX1240S-S005-30X January 2010
6 AX1250S / AX1240S Software Manual
MIB Reference (for Ver. 2.2) AX1240S-S006-30X January 2010
Trademarks
・ Ethernet is a product name of Xerox Corporation.
・ Microsoft is a registered trademark of Microsoft Corporation in the United States and other countries.
・ Windows is a registered trademark of Microsoft Corporation in the United States and other countries.
・ Other company and product names in this manual are trademarks or registered trademarks of their respective owners.
Note
Information in this document is subject to change without notice.
Edition history
March 2010 (Edition 1)
June 2010 (Edition 2)
September 2010 (Edition 3)
Copyright
Copyright (c) 2010, ALAXALA Networks Corporation. All rights reserved.

AX1240S-AP-0202C_R2X
3
History of amendments (Edition 3)
Item
No. Location and title Changes
1 Configuration Guide Vol. 1 Corrections have been added to the filter conditions that can be assigned to the IPv4
access list used for authentication.
The RADIUS server group has been added to the login authentication options.
2 Configuration Guide Vol. 2 Corrections related to the Web browser for Web authentication have been added.
Corrections related to the operating conditions of the authentication functionality
have been added. (IEEE 802.1X, Web authentication, and MAC-based
authentication)
Corrections related to the roaming operating conditions have been added. (Web
authentication and MAC-based authentication)
The example of setting the terminals excluded from authentication in dynamic
VLAN mode has been corrected. (IEEE 802.1X, Web authentication, and
MAC-based authentication)
3 Configuration Command Reference The RADIUS server group (group <group-name>) parameter has been added to
aaa authentication login.
Corrections have been added to the notes on power-control port
cool-standby.
Corrections have been added to the notes on schedule-power-control port
cool-standby.
4 Operation Command Reference Corrections have been added to the descriptions of the show dot1x logging
operation log.
Corrections have been added to the descriptions of the show
web-authentication logging operation log.
Corrections have been added to the descriptions of the show
mac-authentication logging operation log.
5 Message and Log Reference Corrections have been added to Event location = SESSION.
Corrections have been added to Event location = STP.
A log has been added to Event location = FABRIC.
6 MIB Reference Corrections related to the interfaces group (ifNumber) have been added.
Corrections have been added to the dot1dStp group implementation
specifications.
Corrections have been added to the ax1250sChassis group implementation
specifications (chassis information).
Corrections have been added to the ax1250sChassis group implementation
specifications (temperature information).
Corrections have been added to the ax1240sChassis group implementation
specifications (chassis information).
Corrections have been added to the ax1240sChassis group implementation
specifications (temperature information).
Corrections have been added to the supported traps and issuance timings.
History of amendments (Edition 2)
Item
No. Location and title Changes
1 Configuration Guide Vol. 1 Corrections related to the cooling fan were added.
2 MIB Reference Corrections related to the interfaces group were added.

AX1240S-AP-0202C_R2X
4
Contents
1. Changes in Configuration Guide Vol. 1 (For Version 2.2) (AX1240S-S001-30X)....................................... 5
2. Changes in Configuration Guide Vol. 2 (For Version 2.2) (AX1240S-S002-40X)......................................11
3. Changes in Configuration Command Reference (for Ver. 2.2) (AX1240S-S003-30X)............................. 22
4. Changes in Operation Command Reference (for Ver. 2.2) (AX1240S-S004-30X).................................... 27
5. Changes in Message Log Reference (For Version 2.2) (AX1240S-S005-30X)........................................... 30
6. Changes in MIB Reference (For Version 2.2) (AX1240S-S006-30X)......................................................... 33

AX1240S-AP-0202C_R2X
5
1. Changes in Configuration Guide Vol. 1 (For Version
2.2) (AX1240S-S001-30X)
3. Switch Capacities
3.2 Switch Capacities
(13) Layer 2 authentication functionality [Change]
The filter conditions that can be specified for the IPv4 access list used for authentication in Table 3-24 Other capacity
limitations regarding Layer 2 authentication – common functionality have been corrected as follows. [Ver. 2.2.E and
later]
Before the change:
Table 3-24 Other capacity limitations regarding Layer 2 authentication-common functionality
Item Maximum number
Registered general-purpose RADIUS servers 20#1
Access list names that can be specified in an authentication-only IPv4 access list 1
Filter conditions that can be specified in an authentication-only IPv4 access list 20#2
Unauthenticated terminals that can be registered 256#3
#1
This is the number of registered general-purpose RADIUS servers in the whole Switch, including login
security functionality.
#2
If you set a number of filter entries that exceeds the Switch capacity, only the entries within the capacity
limitations are applied.
#3
When the number of unauthenticated terminals exceeds the maximum number, delete those with older update
periods and register newly unauthenticated terminals.
After the change:
Table 3-24 Other capacity limitations regarding Layer 2 authentication-common functionality
Item Maximum number
Registered general-purpose RADIUS servers 20#1
Access list names that can be specified in an authentication-only IPv4 access list 1
Filter conditions that can be specified in an authentication-only IPv4 access list 250#2
Unauthenticated terminals that can be registered 256#3
#1
This is the number of registered general-purpose RADIUS servers in the whole Switch, including login
security functionality.
#2
If you set a number of filter entries that exceeds the Switch capacity, only the entries within the capacity
limitations are applied.
#3
When the number of unauthenticated terminals exceeds the maximum number, delete those with older update
periods and register newly unauthenticated terminals.

AX1240S-AP-0202C_R2X
6
8. Login Security and RADIUS
8.2.3 Authentication via RADIUS
(1) Selection of login authentication service [Change]
The RADIUS server group has been added to the options for login authentication services. [Ver. 2.2.E and later]
Correlation diagram of authentication method configuration has been added in front of Figure 8-7 Authentication
method sequence. Subsequent figure numbers have been changed accordingly.
Before the change:
You can specify more than one service that you wish to use for login authentication. You can specify RADIUS
authentication and you can specify password-based authentication local to the Switch. You can specify only one
of the authentication methods, or both of them. If both are specified and authentication fails with the first
specified method, the second method is used.
The following figure shows the authentication method sequence used if RADIUS and local password
authentication are specified in this order.
Figure 8-7 Authentication method sequence
(The rest omitted)
After the change:
You can specify more than one service that you wish to use for login authentication. You can specify RADIUS
authentication(general-purpose RADIUS server authentication or RADIUS server group authentication)and you
can specify password-based authentication local to the Switch.
The following figure shows a correlation diagram of authentication method settings.
Figure 8-7 Correlation diagram of authentication method settings
Login
authentication
Authentication method selection
: aaa authentication login
Switch default: default
RADIUS authentication
:group radius
Local authentication: local
RADIUS server group
:group group-name
Internal DB#
Select
#: Internal DB
Control table for the user ID and password
used for local password authentication
General-purpose
RADIUS server
[Max. 20 servers]
RADIUS server group
:group group-name
You can specify only one of the authentication methods, or both of them. If both are specified and authentication
fails with the first specified method, the second method is used.
You cannot simultaneously specify both group radius (general-purpose RADIUS server authentication) and

AX1240S-AP-0202C_R2X
7
group <group-name> (RADIUS server group authentication) in the above figure, because both methods are
treated as the RADIUS authentication service. Use either of them in combination with local password
authentication.
The following figure shows the authentication method sequence used if RADIUS and local password
authentication are specified in this order.
Figure 8-8 Authentication method sequence
(The rest omitted)
8.2.4 Connecting with a RADIUS server
(3) RADIUS server information that can be specified in the Switch
[Change]
Before the change:
The Switch allows you to specify the following RADIUS server information:
Information of general-purpose RADIUS servers
This information is used by both the login security and Layer 2 authentication functionality.
Information of authentication-dedicated RADIUS server (IEEE 802.1X, Web authentication, MAC-based
authentication)
This information is only used by each Layer 2 authentication functionality.
RADIUS server group information
General-purpose RADIUS servers are grouped for use by Layer 2 authentication.
After the change:
The Switch allows you to specify the following RADIUS server information:
Information of general-purpose RADIUS servers
This information is used by both the login security and Layer 2 authentication functionality.
Information of authentication-dedicated RADIUS server (IEEE 802.1X, Web authentication, MAC-based
authentication)
This information is only used by each Layer 2 authentication functionality.
RADIUS server group information
General-purpose RADIUS servers are grouped for use by both login authentication and Layer 2
authentication.

AX1240S-AP-0202C_R2X
8
10. Power saving Functionality
10.1 Implementing power saving
10.1.5 Cooling fan control functionality [Change]
Descriptions of this section have been corrected as follows:
Before the change:
This functionality monitors the temperature in the Switch, and if the Switch is located in a favorable environment
that does not require forced cooling, it stops the cooling fan. If the ambient temperature is too high, it starts the
cooling fan to cool the Switch forcibly. In a favorable installation environment, this helps reduce both power
consumption and unwanted noise.
To enable this functionality, set the configuration command system fan-control. (If the system
fan-control configuration command is not set, the cooling fan will always remain on.)
This functionality is supported only by AX1240S-48T2C switches. If the Switch is started with this functionality
set, the cooling fan runs for about 10 minutes after the Switch is started.
After the change:
This functionality monitors the temperature in the Switch, and if the Switch is located in a favorable environment
that does not require forced cooling, it stops the cooling fan. If the ambient temperature is too high, it starts the
cooling fan to cool the Switch forcibly. In a favorable installation environment, this helps reduce both power
consumption and unwanted noise.
To enable this functionality, set the configuration command system fan-control. (If the system
fan-control configuration command is not set, the cooling fan will always remain on.)
Conditions that will cause the fans to start and stop when using this configuration command
Start conditions: When an internal temperature of 47C or higher is detected
Stop conditions: When an internal temperature of 46C or lower continues for 10 minutes after detection
This functionality is supported only by AX1240S-48T2C switches. If the Switch is started with this functionality
set, the cooling fan runs for about 10 minutes after the Switch is started.

AX1240S-AP-0202C_R2X
9
12. Ethernet
12.8 Gigabitethernet (SFP)
12.8.1 Functionality [Change]
Table 12-24 Flow control operation determined by the auto-negotiation result in (4) Flow control has been corrected
as follows:
Before the change:
Table 12-24 Flow control operation determined by the auto-negotiation result
The Switch Remote device Result of auto-negotiation
on the Switch Flow control operation
Send
pause
packet
Receive
pause
packet
Send
pause
packet
Receive
pause
packet
Send
pause
packet
Receive
pause packet Is sending regulated on
the Switch?
Is sending
regulated on the
remote device?
on desired Enabled Enabled on on Yes Yes
Disabled on off No No
desired on on Yes Yes
Disabled Enabled on on No Yes
Disabled on off No No
desired on on Yes Yes
desired Enabled on on Yes Yes
Disabled on off No No
desired on on Yes Yes
off Enabled Enabled on on Yes Yes
Disabled off on No Yes
desired on on Yes Yes
Disabled Enabled on on No Yes
Disabled off off No No
desired on on Yes Yes
desired Enabled on on Yes Yes
Disabled off on No Yes
desired on on Yes Yes
desired on Enabled Enabled on on Yes Yes
Disabled off on Yes No
desired on on Yes Yes
Disabled Enabled on on No Yes
Disabled off on No No
desired on on Yes Yes
desired Enabled on on Yes Yes
Disabled off on No No
desired on on Yes Yes
off Enabled Enabled off off No No
Disabled off off No No
desired off off No No
Disabled Enabled on off No No
Disabled off off No No
desired on off Yes No
desired Enabled off off No No
Disabled off off No No
desired off off Yes No
desired Enabled Enabled on on Yes Yes
Disabled off off No No
desired on on Yes Yes
Disabled Enabled on on No Yes
Disabled off off No No
desired on on Yes Yes
desired
Enabled on on Yes Yes
Disabled off off No No

AX1240S-AP-0202C_R2X
10
desired on on Yes Yes
After the change:
Table 12-24 Flow control operation determined by the auto-negotiation result
The Switch Remote device Result of auto-negotiation
on the Switch Flow control operation
Send
pause
packet
Receive
pause
packet
Send
pause
packet
Receive
pause
packet
Send
pause
packet
Receive
pause packet Is sending regulated on
the Switch?
Is sending
regulated on the
remote device?
on desired Enabled Enabled on on Yes Yes
Disabled off off No No
desired on on Yes Yes
Disabled Enabled on on Yes Yes
Disabled off off No No
desired on on Yes Yes
desired
Enabled on on Yes Yes
Disabled off off No No
desired on on Yes Yes
off Enabled Enabled on on Yes Yes
Disabled off on Yes No
desired on on Yes Yes
Disabled Enabled on on Yes Yes
Disabled off off No No
desired on on Yes Yes
desired
Enabled on on Yes Yes
Disabled off on Yes No
desired on on Yes Yes
desired on Enabled Enabled on on Yes Yes
Disabled off off No No
desired on on Yes Yes
Disabled Enabled on on Yes Yes
Disabled off off No No
desired on on Yes Yes
desired Enabled on on Yes Yes
Disabled off off No No
desired on on Yes Yes
off Enabled Enabled off off No No
Disabled off off No No
desired off off No No
Disabled Enabled on off No Yes
Disabled off off No No
desired on off No Yes
desired
Enabled off off No No
Disabled off off No No
desired off off No No
desired
Enabled Enabled on on Yes Yes
Disabled off off No No
desired on on Yes Yes
Disabled Enabled on on Yes Yes
Disabled off off No No
desired on on Yes Yes
desired Enabled on on Yes Yes
Disabled off off No No
desired on on Yes Yes

AX1240S-AP-0202C_R2X
11
2. Changes in Configuration Guide Vol. 2 (For Version
2.2) (AX1240S-S002-40X)
4. Send Control
4.1 Overview of the shaper
4.1.3 Scheduling [Addition]
Descriptions have been added to Table 4-4 WFQ configuration range as follows:
Before the change:
Table 4-4 WFQ configuration range
Line speed Bandwidth Configuration range Step value
1 Gbit/s 64 Kbit/s-1 Gbit/s Mbit/s 1M-1000M 1 Mbit/s#1
Kbit/s 1000-1000000 100 Kbit/s#2
64-960
64 Kbit/s#3
100 Mbit/s 64 Kbit/s-100 Mbit/s Mbit/s 1M-100M 1 Mbit/s#1
Kbit/s 1000-100000
100 Kbit/s#2
64-960 64 Kbit/s#3
10 Mbit/s 64 Kbit/s-10 Mbit/s Mbit/s 1M-10M 1 Mbit/s#1
Kbit/s 1000-10000
100 Kbit/s#2
64-960
64 Kbit/s#3
Auto Negotiation 64 Kbit/s-1 Gbit/s Mbit/s 1M-1,000M 1 Mbit/s#1
Kbit/s 1000-1000000 100 Kbit/s#2
64-960 64 Kbit/s#3
#1: 1 M = 1000 K.
#2: For values greater than 1000 K, set them in 100 K increments (1000 K, 1100 K, 1200 K...10000000 K).
#3: For values that are less than 1000 K, set them in 64 K increments (64 K, 128 K, 192 K...960 K).
After the change:
The table below shows the WFQ configuration range. WFQ does not work when the line status is half duplex.
Instead, PQ is used for operation.
Table 4-4 WFQ configuration range
Line speed Bandwidth Configuration range Step value
1 Gbit/s 64 Kbit/s-1 Gbit/s Mbit/s 1M-1000M 1 Mbit/s#1
Kbit/s 1,000-1000000 100 Kbit/s#2
64-960 64 Kbit/s#3
100 Mbit/s 64 Kbit/s-100 Mbit/s Mbit/s 1M-100M 1 Mbit/s#1
Kbit/s 1000-100000 100 Kbit/s#2
64-960 64 Kbit/s#3
10 Mbit/s 64 Kbit/s-10 Mbit/s Mbit/s 1M-10M 1 Mbit/s#1
Kbit/s 1000-10000 100 Kbit/s#2
64-960 64 Kbit/s#3
Auto Negotiation 64 Kbit/s-1 Gbit/s Mbit/s 1M-1000M 1 Mbit/s#1
Kbit/s
1000-1000000 100 Kbit/s#2
64-960 64 Kbit/s#3
#1: 1 M = 1000 K.

AX1240S-AP-0202C_R2X
12
#2: For values greater than 1000 K, set them in 100 K increments (1000 K, 1100 K, 1200 K...10000000 K).
#3: For values that are less than 1000 K, set them in 64 K increments (64 K, 128 K, 192 K...960 K).
4.1.4 Port bandwidth control [Change]
The descriptions of Table 4-5 Configuration values for port bandwidth control have been corrected as follows:
Before the change:
The table below shows bandwidths and units for port bandwidth control by line type. This specification depends
on the line type.
Table 4-5 Configuration values for port bandwidth control
Line speed Bandwidth Configuration range Step value
1 Gbit/s 64 Kbit/s-1 Gbit/s Mbit/s 1M-1000M 1 Mbit/s#1
Kbit/s
1000-1000000 100 Kbit/s#2
64-960 64 Kbit/s#3
100 Mbit/s 64 Kbit/s-100 Mbit/s Mbit/s 1M-100M 1 Mbit/s#1
Kbit/s 1000-100000 100 Kbit/s#2
64-960 64 Kbit/s#3
10 Mbit/s 64 Kbit/s-10 Mbit/s Mbit/s 1M-10M 1 Mbit/s#1
Kbit/s
1000-10000 100 Kbit/s#2
64-960 64 Kbit/s#3
Auto Negotiation 64 Kbit/s-1 Gbit/s Mbit/s 1M-1000M 1 Mbit/s#1
Kbit/s
1000-1000000 100 Kbit/s#2
64-960 64 Kbit/s#3
#1: 1 M = 1000 K.
#2: For values greater than 1000 K, set them in 100 K increments (1000 K, 1100 K, 1200 K...10000000 K).
#3: For values that are less than 1000 K, set them in 64 K increments (64 K, 128 K, 192K...960 K).
The range of frames for port bandwidth control is from the MAC header to the FCS. For more details, see
Figure 4-3 Range subject to port bandwidth control.
After the change:
The table below shows the configuration range for port bandwidth control. Set the bandwidth to a lower value than
the line speed. Port bandwidth control does not work when the line status is half duplex.
Table 4-5 Configuration values for port bandwidth control
Line speed Bandwidth Configuration range Step value
1 Gbit/s 64 Kbit/s-1 Gbit/s Mbit/s 1M-1000M 1 Mbit/s#1
Kbit/s
1000-1000000 100 Kbit/s#2
64-960 64 Kbit/s#3
100 Mbit/s 64 Kbit/s-100 Mbit/s Mbit/s 1M-100M 1 Mbit/s#1
Kbit/s 1000-100000 100 Kbit/s#2
64-960 64 Kbit/s#3
10 Mbit/s 64 Kbit/s-10 Mbit/s Mbit/s 1M-10M 1 Mbit/s#1
Kbit/s
1000-10000 100 Kbit/s#2
64-960 64 Kbit/s#3
Auto Negotiation 64 Kbit/s-1 Gbit/s Mbit/s 1M-1,000M 1 Mbit/s#1
Kbit/s
1000-1000000 100 Kbit/s#2
64-960 64 Kbit/s#3
#1: 1 M = 1,000 K.

AX1240S-AP-0202C_R2X
13
#2: For values greater than 1000 K, set them in 100 K increments (1000 K, 1100 K, 1200 K...10000000 K).
#3: For values that are less than 1000 K, set them in 64 K increments (64 K, 128 K, 192K...960 K).
The range of frames for port bandwidth control is from the MAC header to the FCS. For more details, see
Figure 4-3 Range subject to port bandwidth control.
6. Description of IEEE 802.1X
6.1 Overview of IEEE 802.1X
6.1.2 Overview of the extended functionality [Change]
Table 6-4 Operational conditions of IEEE 802.1X has been corrected as follows:
Before the change:
Table 6-4 Operational conditions of IEEE 802.1X
Category Port-based
authentication
(static)
Port-based
authentication
(dynamic)
VLAN-based
authentication
(dynamic)
VLAN type Port VLAN Y Y#--
Protocol VLAN -- -- --
MAC VLAN -- YY
Default VLAN Y -- --
Port type Access port Y -- --
Trunk port -- -- --
Protocol port -- -- --
MAC port Untagged -- YY
Tagged -- -- --
Interface type fastethernet Y YY
gigabitethernet Y YY
port channel Y -- Y
Legend
Y: Available
--: Not available
#
Supported at auto-authentication mode for an untagged frame of a MAC port (see 5.4.4 Auto authentication
mode accommodation at the same MAC port).

AX1240S-AP-0202C_R2X
14
After the change:
Table 6-4 Operational conditions of IEEE 802.1X
Category Configuring
ports Specifiable VLAN type Frame type Port-based authentication
(static)
Port-based
authentication
(dynamic)
VLAN-based
authentication
(dynamic)
Port type Access port native Port VLAN
MAC VLAN
Untagged Y N N
Trunk port native Port VLAN Untagged N N N
allowed Port VLAN
MAC VLAN
Tagged N N N
Protocol port -- -- -- N N N
MAC port native Port VLAN Untagged Y#N N
mac MAC VLAN Untagged N Y Y
dot1q Port VLAN
MAC VLAN
Tagged N N N
Default VLAN Y N N
fastethernet Y Y YInterface
type gigabitethernet Y Y Y
port channel Y N Y
Legend
Y: Available
N: Not available
--: Not applicable for authentication ports
#
For more details, see 5.4.4 Auto authentication mode accommodation at the same MAC port.

AX1240S-AP-0202C_R2X
15
7. IEEE 802.1X Configuration and Operation
7.4 Configuring port-based authentication (dynamic)
7.4.2 Configuring authentication mode options [Change]
In (1) Configuring authentication exclusion options, Configuration command example has been corrected as follows
and notes have been added.
Before the change:
Configuration command example
1. (config)# mac-address-table static 1234.5600.e001 vlan 200 interface fastethernet
0/2
Adds the MAC address (1234.5600.e001) for which you want to permit unauthenticated access to
VLAN ID 200 at port 0/2 to the MAC address table.
2. (config)# vlan 200 mac-based
(config-vlan)# mac-address 1234.5600.e001
(config-vlan)# exit
Specifies that the MAC address (1234.5600.e001) be allowed to access VLAN ID 200. The printer can
now access VLAN ID 200 without performing IEEE 802.1X authentication.
After the change:
Configuration command example
(config)# vlan 200 mac-based
(config-vlan)# mac-address 1234.5600.e001
(config-vlan)# exit
Specifies that the MAC address (1234.5600.e001) be allowed to access VLAN ID 200. The printer can now
access VLAN ID 200 without performing IEEE 802.1X authentication.
(config)# interface gigabitethernet 0/2
(config-if)# switchport mode mac-vlan
(config-if)# switchport mac vlan 200
(config-vlan)# exit
Specifies MAC VLAN ID 200, to which the excluded terminal belongs, to an authentication port.
(config)# mac-address-table static 1234.5600.e001 vlan 200 interface fastethernet 0/2
Adds the MAC address (1234.5600.e001) for which you want to permit unauthenticated access to VLAN
ID 200 at port 0/2 to the MAC address table.
Note
Before adding the terminal excluded from authentication to the MAC address table, specify the VLAN ID of
MAC VLAN to the port to which the terminal belongs.

AX1240S-AP-0202C_R2X
16
8. Description of Web Authentication
8.1 Overview [Change]
Descriptions of this section have been corrected as follows. In addition, Table 8-2 Operating conditions for Web
authentication has been corrected as follows:
Before the change:
In Web authentication, user authentication is based on a user ID and password that a user supplies through an
ordinary Web browser, such as Internet Explorer (abbreviated hereafter to Web browser). The Switches change
the status of the terminal to be authenticated on the basis of the MAC address of this authenticated user's terminal
and grant terminal access to the post-authentication network. (We recommend using Internet Explorer 6 for Web
authentication for the Switch.)
After the change:
In Web authentication, user authentication is based on a user ID and password that a user supplies through an
ordinary Web browser, such as Internet Explorer (abbreviated hereafter to Web browser). The Switches change
the status of the terminal to be authenticated on the basis of the MAC address of this authenticated user's terminal
and grant terminal access to the post-authentication network.
Before the change:
Table 8-2 Operating conditions for Web authentication
Type Fixed VLAN Dynamic VLAN Legacy
VLAN type Port VLAN Y Y#N
Protocol VLAN N N N
MAC VLAN #Y Y
Default VLAN Y N N
Port type Access port Y N N
Trunk port Y N N
Protocol port N N N
MAC port Untagged N Y Y
Tagged
#N N
Interface type fastethernet Y Y Y
gigabitethernet Y Y Y
port channel N N Y
Legend
Y: Enabled
N: Disabled
#: Enabled with the switchport mac dot1q vlan setting.
#
Operation possible when the automatic authentication mode is available untagged frames on a MAC port.
(See 5.4.4 Auto authentication mode accommodation at the same MAC port.)

AX1240S-AP-0202C_R2X
17
After the change:
Table 8-2 Operating conditions for Web authentication
Type Configuring
ports Specifiable VLAN type Frame type Fixed VLAN Dynamic VLAN Legacy
Port type Access port native Port VLAN
MAC VLAN
Untagged Y N N
Trunk port native Port VLAN Untagged Y N N
allowed Port VLAN
MAC VLAN
Tagged Y N N
Protocol port -- -- -- N N N
MAC native Port VLAN Untagged Y#N N
Port mac MAC VLAN Untagged N Y Y
dot1q Port VLAN
MAC VLAN
Tagged Y N N
Default VLAN Y N N
fastethernet Y Y YInterface
type gigabitethernet Y Y Y
port channel N N Y
Legend
Y: Available
N: Not available
--: Not applicable for authentication ports
#
For more details, see 5.4.4 Auto authentication mode accommodation at the same MAC port.
8.3 Dynamic VLAN mode
8.3.2 Authentication functionality [Change]
(7) Roaming (moving authenticated terminals between ports)
[Change]
The roaming operating conditions have been corrected as follows:
Before the change:
Roaming is enabled when any of the following conditions is met:
The web-authentication roaming configuration command is configured.
Ports between which a terminal is moved are in fixed VLAN mode.
The post-authentication VLAN of the port before being switched is configured in the switchport mac vlan
configuration command for the Switch destination port.
After the change:
Roaming is enabled when any of the following conditions is met:
The web-authentication roaming configuration command is configured.
Ports between which a terminal is moved are in fixed VLAN mode.

AX1240S-AP-0202C_R2X
18
9. Web Authentication Configuration and Operation
9.4.2 Configuration related to authentication
(6) Roaming (permitting authenticated port change communication)
configuration [Change]
The notes have been corrected as follows:
Before the change:
Notes:
Roaming is available under any of the following conditions:
Connected to a port subject to dynamic VLAN mode before and after reconnection
Authenticated VLAN before connected to a different port must be configured to the switchport mac
vlan configuration command of the port
After the change:
Note
Roaming is available under any of the following conditions:
Connected to a port subject to dynamic VLAN mode before and after reconnection
(7) Authentication exclusion configuration [Change]
(b) Authentication exclusion terminal configuration, Configuration command example has been corrected as follows
and notes have been added.
Before the change:
Configuration command example
1. (config)# vlan 400 mac-based
(config-vlan)# mac-address 1234.5600.e001
(config-vlan)# exit
Configures the MAC address to be excluded from authentication targets to MAC VLAN ID 400 (MAC
address of the shared printer in the figure: 1234.5600.e001).
2. (config)# mac-address-table static 1234.5600.e001 vlan 400 interface fastethernet
0/5
Configures the MAC address of a terminal to be excluded from authentication targets and where
communication is permitted on port 0/5 of MAC VLAN ID 400 (MAC address of the shared printer in
the figure: 1234.5600.e001) in the MAC address table.
After the change:
Configuration command example
1. (config)# vlan 400 mac-based
(config-vlan)# mac-address 1234.5600.e001
(config-vlan)# exit
Configures the MAC address to be excluded from authentication targets to MAC VLAN ID 400 (MAC

AX1240S-AP-0202C_R2X
19
address of the shared printer in the figure: 1234.5600.e001).
2. (config)# interface fastethernet 0/5
(config-if)# switchport mode mac-vlan
(config-if)# switchport mac vlan 400
(config-vlan)# exit
Specifies MAC VLAN ID 400, to which the excluded terminal belongs, to an authentication port.
3. (config)# mac-address-table static 1234.5600.e001 vlan 400 interface fastethernet
0/5
Configures the MAC address of a terminal to be excluded from authentication targets and where
communication is permitted on port 0/5 of MAC VLAN ID 400 (MAC address of the shared printer in the
figure: 1234.5600.e001) in the MAC address table.
Note Before adding the terminal excluded from authentication to the MAC address table, set the VLAN ID of
MAC VLAN to the port to which the terminal belongs.
10. Description of MAC-based Authentication
10.1 Overview [Change]
Table 10-2 Operating conditions of MAC-based authentication has been corrected as follows:
Before the change:
Table 10-2 Operating conditions of MAC-based authentication
Type Fixed VLAN Dynamic VLAN Legacy
VLAN type Port VLAN Y Y#N
Protocol VLAN N NN
MAC VLAN #YY
Default VLAN Y NN
Port type Access port Y NN
Trunk port Y NN
Protocol port N NN
MAC port Untagged N YY
Tagged
#NN
Interface type fastethernet YYY
gigabitethernet YYY
port channel NNN
Legend
Y: Operable
N: Not operable
#: Operable when switchport mac dot1q vlan is configured
#
Operable when automatic authentication mode is configured for untagged frames on a MAC port (see 5.4.4
Auto authentication mode accommodation at the same MAC port for details).

AX1240S-AP-0202C_R2X
20
After the change:
Table 10-2 Operating conditions of MAC-based authentication
Category Configuring
ports Specifiable VLAN type Frame type Fixed VLAN Dynamic VLAN Legacy
Port type Access port native Port VLAN
MAC VLAN
Untagged Y N N
Trunk port native Port VLAN Untagged Y N N
allowed Port VLAN
MAC VLAN
Tagged Y N N
Protocol
port
-- -- -- N N N
MAC port native Port VLAN Untagged Y#N N
mac MAC VLAN Untagged N Y Y
dot1q Port VLAN
MAC VLAN
Tagged Y N N
Default VLAN Y N N
fastethernet Y Y Y
Interface
type gigabitethernet Y Y Y
port channel N N N
Legend
Y: Operable
N: Not operable
--: Not applicable for authentication ports
#
For more details, see 5.4.4 Auto authentication mode accommodation at the same MAC port.
10.3 Dynamic VLAN mode
10.3.2 Authentication functionality
(8) Roaming (moving authenticated terminals between ports)
[Change]
The roaming operating conditions have been corrected as follows:
Before the change:
Roaming is possible when all of the following conditions are met:
・ The mac-authentication roaming configuration command is set.
・ The ports before and after the move are dynamic VLAN mode ports.
・ The post-authentication VLAN before the move is defined for the port after the move by using the
switchport mac vlan configuration command.
After the change:
Roaming is possible when all of the following conditions are met:
・ The mac-authentication roaming configuration command is set.
・ The ports before and after the move are dynamic VLAN mode ports.