83
dot1x guest-vlan guest-vlan-id
Configuring an Auth-Fail VLAN
Configuration guidelines
Follow these guidelines when configuring an 802.1X Auth-Fail VLAN:
ï‚· Assign different IDs for the voice VLAN, the default VLAN, and the 802.1X guest VLAN on a port, so
the port can correctly process VLAN tagged incoming traffic.
ï‚· You can configure only one 802.1X Auth-Fail VLAN on a port. The 802.1X Auth-Fail VLANs on
different ports can be different.
ï‚· Use Table 7 when configuring multiple security features on a port.
Table 7 Relationships of the 802.1X Auth-Fail VLAN with other features
MAC authentication guest VLAN
on a port that performs MAC-
based access control
The 802.1X Auth-Fail VLAN has a high
priority.
The chapter ―MAC
authentication
configuration‖
Port intrusion protection on a port
that performs MAC-based access
control
The 802.1X Auth-Fail VLAN function has
higher priority than the block MAC action
but lower priority than the shut down port
action of the port intrusion protection
feature.
The chapter ―Port Security
configuration‖
Configuration prerequisites
ï‚· Create the VLAN to be specified as the 802.1X Auth-Fail VLAN
ï‚· If the 802.1X-enabled port performs port-based access control, enable 802.1X multicast trigger.
ï‚· If the 802.1X-enabled port performs MAC-based access control, configure the port as a hybrid port,
enable MAC-based VLAN on the port, and assign the port to the Auth-Fail VLAN as an untagged
member. For more information about the MAC-based VLAN function, see the Layer 2
—
LAN
Switching Configuration Guide.
Follow these steps to configure an Auth-Fail VLAN:
Enter Layer 2 Ethernet interface
view
interface interface-type interface-
number
Configure the Auth-Fail VLAN on
the port
dot1x auth-fail vlan authfail-vlan-
id
Required
By default, no Auth-Fail VLAN is
configured.
To Next Page
Loading...
Need help?
General