Dot1X Critical Vlan - HP HSR6600 Command Reference Manual

Parameters
authfail-vlan-id: Specifies the ID of the Auth-Fail VLAN for the port, in the range of 1 to 4094. Make sure
that the VLAN has been created and is not a super VLAN. For more information about super VLANs, see
Layer 2 LAN Switching Configuration Guide.
—
Usage guidelines
You must enable MAC-based VLAN for an Auth-Fail VLAN to take effect on a port that performs
MAC-based access control.
When you change the access control method from MAC-based to port-based on a port that carries an
Auth-Fail VLAN, the mappings between MAC addresses and the 802.1X Auth-Fail VLAN are removed.
You can use the display mac-vlan command to display MAC-to-VLAN mappings.
You must enable 802.1X multicast trigger function for an Auth-Fail VLAN to take effect on a port that
performs port-based access control.
When you change the access control method from port-based to MAC-based on a port that is in an
Auth-Fail VLAN, the port is removed from the Auth-Fail VLAN.
To delete a VLAN that has been configured as an Auth-Fail VLAN, you must remove the Auth-Fail VLAN
configuration first.
You can configure both an Auth-Fail VLAN and a guest VLAN for a port.
Examples
# Configure VLAN 3 as the Auth-Fail VLAN for port GigabitEthernet 3/0/1.
<Sysname> system-view
[Sysname] interface gigabitethernet 3/0/1
[Sysname-GigabitEthernet3/0/1] dot1x auth-fail vlan 3
Related commands
• dot1x
dot1x port-method
•

dot1x critical vlan

Use dot1x critical vlan to configure an 802.1X critical VLAN on a port for users that fail 802.1X
authentication because all the RADIUS servers in their ISP domains have been unreachable.
Use undo dot1x critical vlan to restore the default.
Syntax
dot1x critical vlan vlan-id
undo dot1x critical vlan
Default
No critical VLAN is configured on any port.
Views
Layer 2 Ethernet interface view
Default command level
2: System level
127