Guest Vlan - 3Com MSR 50 Series Configuration Manual

If the port link type is Access, the port leaves its current VLAN and joins the
■
assigned VLAN.
If the port link type is Trunk, the assigned VLAN is allowed to pass the current
■
trunk port. The default VLAN ID of the port is that of the assigned VLAN.
If the port link type is Hybrid, the assigned VLAN is allowed to pass the current
■
port without carrying the tag. The default VLAN ID of the port is that of the
assigned VLAN.
The assigned VLAN neither changes nor affects the configuration of a port.
However, as the assigned VLAN has higher priority than the user-configured VLAN,
it is the assigned VLAN that takes effect after a user passes authentication. After
the user goes offline, the port returns to its original VLAN.
For details about VLAN configuration, refer to
487.
n
With a Hybrid port, the VLAN assigning will fail if you have configured the
■
assigned VLAN to carry tags.
With a Hybrid port, you cannot configure an assigned VLAN to carry tags after
■
the VLAN has been assigned.

Guest VLAN

Guest VLAN allows unauthenticated users to access some special resources.
Guest VLAN is the default VLAN that a supplicant on a port can access without
authentication. After the supplicant passes 802.1x authentication, the port leaves
the guest VLAN and the supplicant can access other network resources.
A user of the guest VLAN can perform operations such as downloading and
upgrading the authentication client software. If a supplicant does not have the
required authentication client software or the version of the client software is
lower, the supplicant will fail the authentication. If no supplicant on a port passes
authentication in a certain period of time (45 seconds by default), the port is
added into the guest VLAN.
If a device with 802.1x enabled and the guest VLAN correctly configured sends an
EAP-Request/Identity packet for the allowed maximum number of times but gets
no response, it adds the port into the guest VLAN according to port link type in
the similar way as described in VLAN assigning.
When a supplicant added into the guest VLAN initiates another authentication
process, if the authentication is not successful, the supplicant stays in the guest
VLAN; otherwise, two cases may occur:
The authentication server assigns a VLAN: The port leaves the guest VLAN and
■
joins the assigned VLAN. If the supplicant goes offline, the port returns to its
original VLAN, that is, the VLAN to which it is configured to belong and it
belongs before joining the guest VLAN.
The authentication server does not assign any VLAN: The port leaves the guest
■
VLAN and returns to its original VLAN. If the supplicant goes offline, the port
just stays in its original VLAN.
802.1x Overview
"VLAN Configuration" on page
1739