Configuring A Guest Vlan - Dell C9000 Series Networking Configuration Manual

the VLAN for which the port is configured or the VLAN that the authentication server indicates in the
authentication data.
NOTE: Ports cannot be dynamically assigned to the default VLAN.
If the supplicant fails to authenticate for a specified number of times, the authenticator typically does not
enable the port. In some cases this behavior is not appropriate. External users of an enterprise network, for
example, might not be able to be authenticated, but still need access to the network. Also, some dumb-
terminals, such as network printers, do not have 802.1X capability and therefore cannot authenticate
themselves. To be able to connect such devices, they must be allowed access the network without
compromising network security.
The Guest VLAN 802.1X extension addresses this limitation with regard to non-802.1X capable devices and
the Authentication-fail VLAN 802.1X extension addresses this limitation with regard to external users.
• If the supplicant fails authentication a specified number of times, the authenticator places the port in the
Authentication-fail VLAN.
• If a port is already forwarding on the Guest VLAN when 802.1X is enabled, the port is moved out of the
Guest VLAN and the authentication process begins.

Configuring a Guest VLAN

If the supplicant does not respond within a determined amount of time ([reauth-max + 1] * tx-period, the
system assumes that the host does not have 802.1X capability and the port is placed in the Guest VLAN.
NOTE: For more information about configuring timeouts, see
Configure a port to be placed in the Guest VLAN after failing to respond within the timeout period using the
dot1x guest-vlan command from INTERFACE mode. View your configuration using the show config
command from INTERFACE mode or using the show dot1x interface command from EXEC Privilege
mode.
Example of Viewing Configured Authentication
The following examples shows you how to view the configured authentication using the show
configuration command in Interface mode.
Dell(conf-if-Te-2/1)#dot1x guest-vlan 200
Dell(conf-if-Te 2/1))#show config
!
interface TenGigabitEthernet 21
switchport
dot1x guest-vlan 200
no shutdown
Dell(conf-if-Te 2/1))#show config
802.1x information on Te 2/1:
-----------------------------
Dot1x Status:
Port Control:
Port Auth Status:
Re-Authentication:
Untagged VLAN id:
Guest VLAN:
Guest VLAN id:
Auth-Fail VLAN:
Enable
FORCE_AUTHORIZED
UNAUTHORIZED
Disable
200
Enabled
200
Disabled
Configuring Timeouts.
802.1X 114