Dot1X Critical Vlan - HP 5120 SI series Command Reference Manual

undo dot1x auth-fail vlan
View
Layer 2 Ethernet interface view
Default level
2: System level
Parameters
authfail-vlan-id: Specifies the ID of the Auth-Fail VLAN for the port, in the range of 1 to 4094. The VLAN
must already exist. Ensure that the VLAN has been created.
Descriptions
Use the dot1x auth-fail vlan command to configure an Auth-Fail VLAN for a port. An Auth-Fail VLAN
accommodates users that have failed 802.1X authentication because of the failure to comply with the
organization security strategy, such as using a wrong password.
Use the undo dot1x auth-fail vlan command to restore the default.
By default, no Auth-Fail VLAN is configured on a port.
You must enable MAC-based VLAN for an Auth-Fail VLAN to take effect on a port that performs
MAC-based access control.
When you change the access control method from MAC-based to port-based on a port that carries an
Auth-Fail VLAN, the mappings between MAC addresses and the 802.1X Auth-Fail VLAN are removed.
You can use the display mac-vlan command to display MAC-to-VLAN mappings.
You must enable 802.1X multicast trigger function for an Auth-Fail VLAN to take effect on a port that
performs port-based access control.
When you change the access control method from port-based to MAC-based on a port that is in an
Auth-Fail VLAN, the port is removed from the Auth-Fail VLAN.
To delete a VLAN that has been configured as an Auth-Fail VLAN, you must remove the Auth-Fail VLAN
configuration first.
Related commands: dot1x and dot1x port-method.
Examples
# Configure VLAN 3 as the Auth-Fail VLAN for port GigabitEthernet 1/0/1.
<Sysname> system-view
[Sysname] interface gigabitethernet 1/0/1
[Sysname-GigabitEthernet1/0/1] dot1x auth-fail vlan 3

dot1x critical vlan

Syntax
dot1x critical vlan vlan-id
undo dot1x critical vlan
View
Layer 2 Ethernet interface view
97