Dot1X Guest-Vlan - Cisco Catalyst 3750 Command Reference Manual

Chapter 2 Catalyst 3750 Switch Cisco IOS Commands

dot1x guest-vlan

Use the dot1x guest-vlan interface configuration command on the switch stack or on a standalone switch
to specify an active VLAN as an 802.1x guest VLAN. Use the no form of this command to return to the
default setting.
Syntax Description
vlan-id
Defaults No guest VLAN is configured.
Command Modes Interface configuration
Command History Release
12.1(14)EA1
12.2(25)SE
Usage Guidelines
For each 802.1x port on the switch, you can configure a guest VLAN to provide limited services to
clients (a device or workstation connected to the switch), such as downloading the 802.1x client
software. These users might be upgrading their systems for 802.1x authentication, and some hosts, such
as Windows 98 systems, might not be 802.1x-capable.
When you enable a guest VLAN on an 802.1x port, the switch assigns clients to a guest VLAN when the
authentication server does not receive a response to its Extensible Authentication Protocol over LAN
(EAPOL) request/identity frame or when EAPOL packets are not sent by the client.
Before Cisco IOS Release 12.2(25)SE, the switch did not maintain the EAPOL packet history and
allowed clients that failed authentication access to the guest VLAN, regardless of whether EAPOL
packets had been detected on the interface. You can use the dot1x guest-vlan supplicant global
configuration command to enable this optional behavior.
With Cisco IOS Release 12.2(25)SE and later, the switch maintains the EAPOL packet history. If another
EAPOL packet is detected on the interface during the lifetime of the link, network access is denied. The
EAPOL history is reset upon loss of link.
Any number of non-802.1x-capable clients are allowed access when the switch port is moved to the guest
VLAN. If an 802.1x-capable client joins the same port on which the guest VLAN is configured, the port
is put into the unauthorized state in the user-configured access VLAN, and authentication is restarted.
Guest VLANs are supported on 802.1x ports in single-host or multiple-hosts mode.
You can configure any active VLAN except an RSPAN VLAN, private VLAN, or a voice VLAN as an
802.1x guest VLAN. The guest VLAN feature is not supported on internal VLANs (routed ports) or
trunk ports; it is supported only on access ports.
78-16181-03
dot1x guest-vlan vlan-id
no dot1x guest-vlan
Specify an active VLAN as an 802.1x guest VLAN. The range is 1 to 4094.
Modification
This command was introduced.
This command was modified to change the default guest VLAN behavior.
Catalyst 3750 Switch Command Reference
dot1x guest-vlan
2-81