DES-3028 DES-3028P DES-3052 DES-3052P Layer 2 Fast Ethernet Managed Switch
Guest VLANs
Figure 10- 17. Guest VLAN Authentication Process
On 802.1x security enabled networks, there is a need for non 802.1x
supported devices to gain limited access to the network, due to lac
of the proper 802.1x software or incompatible devices, such as
computers running Windows 98 or lower operating systems, or the
need for guests to gain access to the network without full
authorization. To supplement these circumstances, this switch now
implements Guest 802.1x VLANs. These VLANs should have
limited access rights and features separate from other VLANs on
the network.
To implement Guest 802.1x VLANs, the user must first create a
VLAN on the network with limited rights and then enable it as an
802.1x guest VLAN. Then the administrator must configure the
guest accounts accessing the Switch to be placed in a Guest VLAN
when trying to access the Switch. Upon initial entry to the Switch,
the client wishing services on the Switch will need to be
authenticated by a remote RADIUS Server on the Switch to be
laced in a fully operational VLAN. If authenticated and the
authenticator posseses the VLAN placement information, that client
will be accepted into the fully operational target VLAN and normal
switch functions will be open to the client. If the authenticator does
not have target VLAN placement information, the swtich will create
a VLAN and the client will be placed in this VLAN. Yet, if the
client is denied authentication by the authenticator, it will be
laced
in the Guest VLAN where it has limited rights and access. The
adjacent figure should give the user a better understanding of the
Guest VLAN process.
Client Placed
Guest VLAN
Limitations Using the Guest VLAN
1. Guest VLANs are only supported for port-based VLANs. MAC-based VLANs cannot undergo this procedure.
2. Ports supporting Guest VLANs cannot be GVRP enabled and vice versa.
3. A port cannot be a member of a Guest VLAN and a static VLAN simultaneously.
4. Once a client has been accepted into the target VLAN, it can no longer access the Guest VLAN.
5. If a port is a member of multiple VLANs, it cannot become a member of the Guest VLAN.
151
To Next Page
Loading...
Need help?
General