HP ProCurve J8162A Manual

Access Controller xl Module Supplement
to the HP ProCurve 6400cl/5300xl/3400cl
Management and Configuration Guide.
This supplement describes the configuration, operation, and monitoring of the ProCurve Access
Controller xl Module (J8162A) on the HP ProCurve Series 5300xl switches.
Related HP ProCurve Switch 5300xl Series publications include:
 HP ProCurve xl Modules Installation Guide
 HP ProCurve Secure Access 700wl Series Management and Configuration Guide
HP periodically updates switch software and product manuals,and posts them on the world wide
Web. For the latest software release and publications for yourHP networking product,visit
http://www.hp.com/go/procurve. Click on Software updates to check on the latest software releases.
Click on Technical support, then Product manuals (all)to check on the latest publications.

© Copyright 2005 Hewlett-Packard Company, LP. The
informationcontainedhereinissubjecttochangewithout
notice.
Publication Number
5991-2136
March, 2005
Applicable Products
HP ProCurve Switch 5304xl (J4850A)
HP ProCurve Switch 5308xl (J4819A)
HP ProCurve Switch 5348xl (J4849A)
HP ProCurve Switch 5372xl (J4848A)
HP ProCurve Switch 5304xl-G32 (J8166A)
HP ProCurve Switch 5308xl-G48 (J8167A)
ProCurve AccessController xl Module (J8162A)
HP ProCurve Access Control Server 740wl (J8154A)
HP ProCurve Integrated Access Manager 760wl (J8155A)
Trademark Credits
Microsoft®, Windows®, and Windows NT® are US
registered trademarks of Microsoft Corporation.
Adobe® and Acrobat® are trademarks of Adobe Systems
Incorporated.
Hewlett-Packard Company
8000 Foothills Boulevard, m/s 5551
Roseville, California 95747-5551
http://www.hp.com/go/procurve
Disclaimer
The information contained inthis document is subject to
change without notice.
HEWLETT-PACKARD COMPANY MAKES NO WARRANTY
OF ANY KIND WITH REGARD TO THIS MATERIAL,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS
FORA PARTICULAR PURPOSE. Hewlett-Packard shall not
be liable for errors contained herein or for incidental or
consequential damages in connection with the furnishing,
performance, or use of this material.
The only warrantiesfor HP products and services are set
forth in the express warranty statements accompanying
such products and services. Nothing herein should be
construed as constituting an additional warranty. HP shall
not be liable for technical or editorial errorsor omissions
contained herein.
Hewlett-Packard assumes no responsibility for the use or
reliability of its software on equipment that is not furnished
by Hewlett-Packard.
Warranty
See the Customer Support/Warranty booklet included with
the product.
A copy of the specific warranty terms applicable to your
Hewlett-Packard products and replacement parts can be
obtained from your HP Sales and Service Office or
authorized dealer.
ii

Contents
Contents
Applicable Switch Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Applicable Secure Access 700wl Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
General Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Related Publications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
Access Controller xl Module Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Module Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Using 5300xl Features with the AccessController xl Module . . . . . . . . . . . 6
Routing Infrastructure Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Using 5300xl Switch Network Address Translation with the ACM . . 11
The Role of VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Client VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Static VLAN Features Supported on Client VLANs . . . . . . . . . . . . 13
General Operating Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Configuring the ACM on the Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Configuring the Access Controller xl Module . . . . . . . . . . . . . . . . . . . . . . . 16
Configuring Downlink Client Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Changing the VLAN-Base . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Configuring Client VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Configuring Uplink Network Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Configuring the Uplink VLAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
ACM Configuration Commands Summary and Syntax . . . . . . . . . . . . 20
Configuration Context Command Syntax . . . . . . . . . . . . . . . . . . . . 20
Access Controller Context Command Syntax . . . . . . . . . . . . . . . . 22
Displaying Access Controller xl Status from the 5300xl CLI . . . . . . . . . . . 24
ACM Display Commands Summary and Syntax . . . . . . . . . . . . . . . . . . 24
Configuration Context Command Syntax . . . . . . . . . . . . . . . . . . . . 25
Access Controller Context Command Syntax . . . . . . . . . . . . . . . . 26
Managing the ACM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Using the ACM’s Extended CLI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Downloading New Software to the Module . . . . . . . . . . . . . . . . . . . . . . 30
iii

Resetting the Module to Factory Defaults . . . . . . . . . . . . . . . . . . . . . . . 30
Operating Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
BIOS POST Event Log Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Applicable Switch Models
Applicable Switch Models
The Access Controller xl Module (J8162A) described in thissupplement
operates on the HP ProCurve Series 5300xl switches.
The 5300xl switch software must be updated to version E.09.21 or later.
Applicable Secure Access 700wl Models
The Access Control Server 740wl or theIntegrated Access Manager 760wl
must use software version 4.1.3.93 or later.
Introduction
The ProCurve Access Controller xl Module (ACM) enables secure, mobile user
access to appropriate network services on any ProCurveSeries 5300xl switch.
This modular addition to the 5300xl switch offers a unique approach to
integrating identity-based user access control, wireless data privacy and
secure roaming with the flexibility of a full-featuredintelligent edge switch.
Centrally configured and managed access policies provide identity-based
access control to wired and wireless users.
General Operation
The Access Controller xl Module (J8162A) uses ports on a 5300xl switch to
pass wired and wireless traffic to and from the network using authentication
and rights administration policiesfroman Access Control Server 740wl or an
Integrated Access Manager 760wl. Up to two ACMsmay be used in a single
5300xl switch. Once the ACM is installed in the switch, connected to the
Access Control Server (740wl or 760wl), and configured for operation, it is
managed from the Administrative Console of the Secure Access 740wl or
760wlproducts.
1

Introduction
Related Publications
This supplement introduces Access Controller xl Module operation, configu-
ration, and monitoring. The following two manuals provide further informa-
tion:
 For information on installing the ACM, refer to the HP ProCurve xl
Modules Installation Guide provided with the module.
 To helpyou manage and configure the ACM in your network,refer to
the HP ProCurve Secure Access 700wl Series Management and
Configuration Guide, which is available from either of the following
sources:
• The Documentation CD-ROM shipped with yourmodule
• The ProCurve Networking Web site at
http://www.hp.com/go/procurve. (Click on Technical support, then Prod-
uct manuals (all).)
Terminology
Term Use in this Manual
Access Control
Server A centralized resource on the network that provides services, such as authentication management, mobility management (roaming support),
policy management, and system monitoringand reporting, to the
connected Access Controllers.
The Access Control Server is deployed as a dedicated control function
and does not sit in the user data path. The Secure Access 700wl Series
has two products that provide this capability: the ProCurve Access
Control Server 740wl and the Integrated Access Manager 760wl.
Client A device looking to access the network.
Client VLAN A special VLAN created to handle downlinkclientporttrafficfortheACM.
Includes the downlink client port (with untagged VLAN membership) and
the downlink port (<slot-id>DP) (with tagged VLAN membership).
Downlink Client
Ports Series 5300xl switch ports assigned as an untagged member to a client VLAN to supply client connectivity.
Downlink Port The internal port that carries client traffic to and from the ACM. This port
is identified by the slot ID where the module is installed, combined with
‘DP’. For example, CDP is the downlink port for an ACM installed in slot
Cof a 5300xl switch.
2

Access Controllerxl Module Overview
Term Use in this Manual
Integrated
Access
Manager 760wl
Combines the functionality of the ProCurve Access Controller 720wl and
the ProCurve Access Control Server 740wl in a single device.
Uplink Port The internal port that carries ACM traffic to and from the network. Must
be an untagged member of a non-client VLAN. This port is identified by
theslotIDwherethemoduleisinstalled,combinedwith‘UP.’Forexample,
CUP is the uplink port for an ACM installed in slot C of a 5300xl switch.
Uplink Network
Ports Any 5300xl port that is a member of the uplink VLAN.
Uplink VLAN The VLAN containingthe uplink port asanuntagged member. By default,
this is the DEFAULT_VLAN on the 5300xl switch.
Access Controller xl Module Overview
The Access Controller xl Module adds new wireless security and access
control capabilities to the 5300xl switch. The module supplies identity-based
useraccess control to specific network services, wireless data privacy with
VPN services, and application persistence across subnet boundaries at the
edge of the network, where users connect. Centrally managed from the
ProCurve Secure Access Control Server 740wl or Integrated Access Manager
760wl, the Access Controller xl Moduleprovides hassle-free access while
maintaining a high level ofsecurity.
3

Access Controller xl Module Overview
Module Operation
Figure 1 below presents the module’s key components. Eachcomponent is
then discussed.
Figure 1. The Access Controller xlModule Conceptual View
The Access Controller xl Module has noexternal ports, as shown in Figure 1.
The module uses ports on the 5300xl switch through two internal ports, the
uplink port and the downlink port. Clients, typically connectingthrough an
access point, connect to 5300xl ports defined as downlink client ports. The
internal uplink port passes network traffic through other 5300xl ports, which
are external uplink network ports. VLANs are used to direct traffic toand from
the ACM.
For an explanation of the module’s features and LEDs, see the HP ProCurve
xl Modules Installation Guide.
4

Access Controllerxl Module Overview
Note Uplink and downlink port names depend on the switch slot where the module
is installed.When the module is in switch slot A, ‘N’ is ‘A’ in Figure 1. The uplink
port for the module is AUP; the downlink port is ADP.
The following steps are required to add an ACM to your network:
1. Install an Access Control Server 740wl or Integrated Access Manager
760wl in the network, or identify an existing 740wl or 760wl to be used
with the ACM.
2. Having identified the Access Control Server 740wl or Integrated Access
Manager 760wl to be used with the ACM, note its IP address. To operate,
the ACM must establish secure communications with the Access Control
Server or IntegratedAccess Manager.
The shared secret configured on the 740wl/760wl’s is also needed. If you
are already using a 760wl, you may not haveconfigured a shared secret.
See “Editing the AccessControl ServerConfiguration”in theHP ProCurve
Secure Access 700wl Series Management and Configuration Guide,
available on the Documentation CD-ROM shipped with your module or
from the ProCurve Networking Web site at
http://www.hp.com/go/procurve (Click on Technical support, then Product
manuals (all)).
3. Install the ACM in a slot on the 5300xl switch. Once the Module Ready
LED is on, the ACM requires an IP address. By default, the ACM uses
DHCP. The IP address also can be set manually. The uplink port must be
an untagged member of a VLAN that can communicate with the 740wl or
760wl. The ACM establishes communication with the 740wl/760wl, using
the IP address and the shared secret from step 2 above. See the HP
ProCurve xl Modules Installation Guide for details.
4. Configure downlink client ports, client VLANs, uplink network ports, and
the uplink VLAN on the 5300xl switch. Configure access and user/group
policy rights on the 740wl/760wl to support and manage clients and client
traffic through the ACM.
5. Manage and monitor the ACM using the Administrative Console on a
740wl or 760wl.
There are specific installation and operational requirements for thisdevice as
a module in a Series 5300xl switch. The following sections describe how the
moduleoperates and how it is configured for use.
5

Using 5300xl Features with the Access Controller xl Module
Using 5300xl Features with the Access
Controller xl Module
As the ACM uses special ports and VLANs to provide access security to
wireless devices, not all of the features of the 5300xl switch are applicable.
For example, features that provide an alternative means of authentication are
not supported on ACM downlink client ports.
Some 5300xl configurations are not allowed by the Command Line Interface
(CLI). When a CLI command fails, a message is displayed explaining why.
Warning messages are issued when an operation could potentially cause
problems managing traffic through the ACM. For example, if a downlink client
port is assigned to a non-client VLAN, traffic could enter the network without
first being authenticated and assigned specific access rights by the ACM. In
this case,a warning message is issued stating that the port is a member of a
client VLAN. In some cases Log messages are also created when an operation
is done, noting the potential conflict with ACM operation.
Note 5300xl switch ports that are not used by the Access Controller xl Module (that
is, they are not downlink client ports, or members of client VLANs) continue
to operate as regular 5300xl ports. Their operation is not affected.
The table below presents the 5300xl switch features that are not supported
for use with an ACM module.
Table 1. 5300xl Switch Features Not Supported on an ACM
Downlink Client Ports Downlink Port Uplink Port Client VLANs
Feature Explanation
802.1X x x x Not allowed.
ACL x Has no effect if assigned. Warning issued
CDP x x Set to off for these ports.
‘x’ indicates that the feature is not supported.
6

Using 5300xl Features with the Access Controller xl Module
Table 1. 5300xl Switch Features Not Supported on an ACM (Continued)
Downlink Client Ports Downlink Port ClientVLANs Uplink Port
Feature Explanation
Configuring IP
Addresses x Not allowed.
DHCP/DHCP Relay x Not allowed.
IP HelperAddress x Not allowed.
Flow Control Not supported across an ACM.
GVRP x x x x 1. GVRP cannot be enabled on an uplink,
downlink, or downlink client port.
2. A port in a GVRP VLAN cannot be added
to a client VLAN.
3. If GVRP is enabled on a port when it is
added to a client VLAN, it is disabled.
IGMP x x x IGMP cannot be enabled on client
VLANs.As a result, it cannot be enabled on
downlink client ports.
Interface Monitoring x x x Cannot be used as a monitoring port.
(Port Mirroring)
Interface Provisioning:
Speed
Duplex
Flow-Control
Auto-MDIX mode
x x Fixed at 1000Mbps.
x x Fixed at Full-Duplex.
x x Not allowed.
x x Not allowed.
IP Routing/
Multicast Routing
x
x No routing is done. Not allowed.
IP Stacking Not supported across an ACM.
IRDP x Not allowed.
Link Test x x Testpacketsnot supportedacross anACM.
LLDP x x Set to off.
‘x’ indicates that the feature is not supported.
7

Using 5300xl Features with the Access Controller xl Module
Table 1. 5300xl Switch Features Not Supported on an ACM (Continued)
Downlink Client Ports Downlink Port Uplink Port ClientVLANs
Feature Explanation
MAC Auth x x x Not allowed.
Meshing x x x Not allowed
x Mesh ports cannot be a member of a client
VLAN.
MSTP (802.1s) An MSTP region may not span across an
ACM.
OSPF x Not allowed.
PIM x Not allowed.
RIP x Not allowed.
StaticVLANs See table 2 below.
Trunkinga:
LACP x x x x Not allowed.
FEC x x x x Not allowed.
Virus Throttling x x x Not supported.
Web Auth x x x Not allowed.
XRRP x Not allowed.
‘x’ indicates that the feature is not supported.
a. A 5300xl switch trunk group that is configured using the trunk option, can
be added to a client VLAN.
8

Using 5300xl Features with the Access Controller xl Module
Routing Infrastructure Support
The ACM uses IP to communicate with Access Control Server740wls, Inte-
grated Access Managers 760wls and Access Controller 720wls. The default
gateway must be set up correctly if there is a router in the communications
path. Figure 2 shows an ACM communicating with its 740wl/760wl through a
router.
Figure 2. Accessing a 740wl or 760wl Through a Router
9

Using 5300xl Features with the Access Controller xl Module
The ACM does not support any routing infrastructure attached to a downlink
client port. Figure 3 below shows how an ACM can be usedto communicate
with a lower-level, non-routed network structure through a downlink client
port.
Figure 3. A Downlink Client Port with a Non-RoutedNetwork Structure
10

Using 5300xl Features with the Access Controller xl Module
Using 5300xl Switch Network Address Translation with
the ACM
The Secure Access 700wl series products and the ACM provide network
address translation for client traffic. The 5300xl switch’snetwork address
translation feature is not recommended for use with the ACM.
The Role of VLANs
VLANs are usedby the Access Controller xl Module to manage client traffic
through the switch. Downlink client ports, connecting to access points, either
directly or through an intermediate network, are assigned as untagged mem-
bers to a unique VLAN that also includes the downlink port as a tagged
member. Traffic from the downlink client port, passing inbound through the
downlink port on its way to the Access Controller xl Module, is normally
tagged with the downlink client port’sVLAN ID (VID), except when traffic is
being bridged (see “Operating Notes” on page 31). The correct authentication
policies and access policies are applied to this inbound client traffic by the
Access Controller xl Module, based, in part, on the VLAN tag the traffic carries.
In a similar fashion, ACM traffic outbound to the network uses a VLAN to
connect to the correctswitch port. The uplink network port is an untagged
member of the uplink VLAN, which by default is the 5300xl DEFAULT_VLAN.
All switch ports that belong to the uplink VLAN are uplink network ports. The
uplink VLAN may be changed by creating a new VLAN and assigning the uplink
port to it as an untagged member. Any ports that belong to the new VLAN are
uplink network ports, carrying ACM traffic to and from the network.
Client VLANs
Client VLANs are special VLANs used by the modulefor client traffic. They
have the following characteristics:
 Up to 24 client VLANs, depending on yourconfiguration, may be used
on a 5300xl switch. If two Access Controller xl Modules are installed
in a 5300xl switch, the total number of VLANs used bythe two
modules may not exceed 24.
 Uplink network ports may not be members of a client VLAN.
11

Using 5300xl Features with the Access Controller xl Module
When a port is added to a client VLAN the following changes are made to the
port:
 Information used for ARP and MAC address processing is flushed.
 If GVRP is enabled, it is disabled and a message is displayed.
 If LACP passive is configured, it is disabled and a message is
displayed.
Downlink client ports must be members of some other VLAN before they can
be removed from a client VLAN. If you use the no access-controller <slot-id>
client-ports [e] <port-list> command to remove an untagged downlink client
port with no other VLAN memberships from a client VLAN, the port is
automatically placed in the DEFAULT-VLAN as an untagged member. If you
attempt to remove a tagged downlink client port that belongs tono other
VLAN, the removal fails. Add the port toanother VLAN, then delete it from the
client VLAN.
ClientVLANs can be configured without specifying any switch ports using the
access-controller <slot-id> client-ports vlan <vlan-list>command from the con-
figuration context. The VLANs are created with only the downlink port,
<slot-id>DP, as a tagged member. Later you can use VLAN commands from the
5300xl CLI to add switch ports to this VLAN as downlink client ports.
12

Using 5300xl Features with the Access Controller xl Module
Static VLAN Features Supported on Client VLANs
Client VLANs are special and they don’t support all of the features of a regular
5300xl static VLAN. Table 2 below outlines the feature limitations of client
VLANs.
Table 2. 5300xl Static VLAN Features on Client VLANs
5300xl Static VLAN Feature Client VLAN Support
ACLs
IGMP
IP Address
IP Helper Address
IRDP
Management VLAN
Multicast routing
OSPF
PIM
Primary VLAN
Protocol VLAN
RIP
XRRP
Do not work. A warning issued.
Not allowed.
Not allowed.
Not allowed.
Not allowed.
A client VLAN may not be used.
Not allowed.
Not allowed.
Not allowed.
A client VLAN may not be used.
A client VLAN may not be used.
Not allowed.
Not allowed.
13

General Operating Rules
General Operating Rules
 Uplink and downlink ports cannot be members of the same VLAN.
 Switch 5300xl features used to manage ports thatare connected to
bridges don’t apply, as the ACM is not a bridge.
 A client VLAN containing the downlink port, <slot-id>DP, is automat-
ically created when the ACM is installed in a 5300xl switch. The VID
for this VLAN is the vlan-base (default: 2000). You cannot remove a
client VLAN if it is the only remaining VLAN with the downlink port
as a member.
 Client VLANs may not be configured as the Management or Primary
VLAN on the 5300xl switch.
 Multiple subnets on a downlink client port are not supported.
 Shut down the ACM
• before resetting or reloading the 5300xl chassis
• before turning off the 5300xl chassis.
• before removing the module from the 5300xl chassis.
See the shutdown command in “ACM Configuration Commands Summary
and Syntax” on page 20.
Configuring the ACM on the Network
By default, the ACM uses DHCP to get an IP address. The uplink port of the
ACM must be an untagged member of a VLAN that can communicate with the
740wl/760wl. If that communication is routed, the Default gateway: needs to be
present inthe IP address configuration. Whenthe IP address is assigned
manually be sure to configure the Default gateway: if it isneeded. (See“Using
the ACM’s Extended CLI” on page 27.)
Use the following commands to configure an IP address manually.
Note ‘HPswitch’ is used as a generic prompt for all 5300xl switches. The term ‘id’ is
used below for ‘slot-id’ toshorten the command prompt.
14

Configuring the ACM on the Network
HPswitch (config)# access-controller <slot-id>
where <slot-id> is the slot in the 5300xl where the ACM is installed.
HPswitch (access-controller-id)#ip address<<ip-addr>/<1-32> |<ip-addr><mask>>
where <ip-addr>/<1...32> is the selected address inCIDR notation (/mask
bit number), for example 10.1.2.3/24.
<ip-addr> <mask>provides the selectedaddress and the mask.
If necessary, use the following command to set or changethe default gateway:
HPswitch (access-controller-id)# ipdefault-gateway <ip-addr>
where <ip-addr> is the numeric IP address of the default gateway, for
example 10.1.2.3.
Use the IP address of the 740wl/760wl and its shared secret to establish
communications with the ACM.
HPswitch (access-controller-id)# access-control-server ip <ip-addr> secret
<secret><secret>
where <ip-addr> is the address of the 740wl/760wl
<secret> is the shared secret configured on the 740wl/760wl.
In the following example, an ACM establishes communications with an access
control server with IP address 13.13.13.8. The access control server has a
shared secret of 7734Oh. The show status command is usedto confirm that
communications has been established, indicated bya time value displayed
(2 secs) in the Connected: field.
15

Configuring the Access Controller xl Module
Configuring the Access Controller xl
Module
Once the module has an IP address and is communicating with its Access
Control Server or IntegratedAccess Manager, configure downlink clientports,
client VLANs, uplink network ports, and the uplink VLANs on the 5300xl
switch.
Configuring Downlink Client Ports
Eachdownlink client port is automatically assigned to a unique client VLAN.
The VID of the first client VLAN configured isspecified by the vlan-base
(default: 2000). Additional client VLANs use the next available sequential VID
(2001, 2002, 2003, ...). If two Access Controller xl Modules are installed in the
5300xl switch, the vlan-base is the VID of the first client VLAN configured by
either ACM. The next client VLAN configured on either ACM uses the next
available sequential VID. Switch ports become untagged members of the client
VLAN. The downlink port also becomes a tagged member of the client VLAN.
From the CLI command promptat the global configuration level, enter
HPswitch (config) #access-controller <slot-id> client-ports <port list>
where
<slot-id> is the slot letter where the module is installed.
<port list> is the switch port(s) to be used as downlink client ports.
For example:
HPswitch (config)# access-controller b client-ports a2,a6
assigns two downlink client ports and two new client VLANs (see Figure 4).
BDP, the downlink port for the module in slot B, is a tagged member of both
client VLANs.
16