Configuring A Guest Vlan - Cisco Catalyst 3560-X Software Configuration Manual

Configuring 802.1x Authentication
The following example shows how to create a DHCP filter containing a list of options:
Switch> enable
Switch# configure terminal
Switch(config)# device-sensor filter-list dhcp list dhcp-list
Switch(config)# device-sensor filter-list dhcp list dhcp-list
Switch(config-sensor-dhcplist)# option name domain-name
Switch(config-sensor-dhcplist)# option name host-name
Switch(config-sensor-dhcplist)# option number 50
Switch(config-sensor-dhcplist)# end
The following example shows how to apply a CDP TLV filter list to the Device Sensor output:
Switch> enable
Switch# configure terminal
Switch(config)# device-sensor filter-spec cdp include cdp-list1
The following example shows how to enable client notifications and accounting events for all TLV
changes:
Switch> enable
Switch# configure terminal
Switch(config)# device-sensor notify all-changes

Configuring a Guest VLAN

When you configure a guest VLAN, clients that are not 802.1x-capable are put into the guest VLAN
when the server does not receive a response to its EAP request/identity frame. Clients that are
802.1x-capable but that fail authentication are not granted network access. The switch supports guest
VLANs in single-host or multiple-hosts mode.
Beginning in privileged EXEC mode, follow these steps to configure a guest VLAN. This procedure is
optional.
Command
Step 1 configure terminal
Step 2 interface interface-id
Step 3 switchport mode access
or
switchport mode private-vlan host
Step 4
dot1x port-control auto
Step 5
authentication event no-response
action authorize vlan vlan-id
Step 6 end
Catalyst 3750-X and 3560-X Switch Software Configuration Guide
1-60
Chapter 1
Purpose
Enter global configuration mode.
Specify the port to be configured, and enter interface configuration mode.
For the supported port types, see the
Configuration Guidelines" section on page
Set the port to access mode,
or
Configure the Layer 2 port as a private-VLAN host port.
Enable 802.1x authentication on the port.
Specify an active VLAN as an 802.1x guest VLAN. The range is 1 to
4094.
You can configure any active VLAN except an internal VLAN (routed
port), an RSPAN VLAN, a primary private VLAN, or a voice VLAN as
an 802.1x guest VLAN.
Return to privileged EXEC mode.
Configuring IEEE 802.1x Port-Based Authentication
"802.1x Authentication
1-39.
OL-25303-03