Table of Contents
Advertisement
Item
Guest VLAN
Enabled
Port State
RocketLinx MP1204-XT User Guide: 2000644 Rev. A
Configuration | Security | Network | NAS (Continued)
When Guest VLAN is both globally enabled and enabled (checked) for a given port,
the switch considers moving the port into the Guest VLAN according to the rules
outlined below.
This option is only available for EAPOL-based modes:
•
Port-based 802.1X
•
Single 802.1X
•
Multi 802.1X
For troubleshooting VLAN assignments, use the Monitor | VLANs | VLAN
Membership and VLAN Port pages. These pages show which modules have
(temporarily) overridden the current Port VLAN configuration.
Guest VLAN Operation:
When a Guest VLAN enabled ports link comes up, the MP1204-XT starts
transmitting EAPOL Request Identity frames. If the number of transmissions of
such frames exceeds Max. Reauth. Count and no EAPOL frames have been received
in the meanwhile, the MP1204-XT considers entering the Guest VLAN. The
interval between transmission of EAPOL Request Identity frames is configured
with EAPOL Timeout. If Allow Guest VLAN if EAPOL Seen is enabled, the port is
now be placed in the Guest VLAN. If disabled, the MP1204-XT first checks its
history to see if an EAPOL frame has previously been received on the port (this
history is cleared if the port link goes down or the ports Admin State is changed),
and if not, the port is placed in the Guest VLAN. Otherwise it does not move to the
Guest VLAN, but continue transmitting EAPOL Request Identity frames at the
rate given by EAPOL Timeout.
Once in the Guest VLAN, the port is considered authenticated, and all attached
clients on the port are allowed access on this VLAN. The MP1204-XT does not
transmit an EAPOL Success frame when entering the Guest VLAN.
While in the Guest VLAN, the MP1204-XT monitors the link for EAPOL frames,
and if one such frame is received, the MP1204-XT immediately takes the port out
of the Guest VLAN and starts authenticating the supplicant according to the port
mode. If an EAPOL frame is received, the port is never able to go back into the
Guest VLAN if the Allow Guest VLAN if EAPOL Seen is disabled.
The current state of the port. It can undertake one of the following values:
•
Globally Disabled: NAS is globally disabled.
•
Link Down: NAS is globally enabled, but there is no link on the port.
•
Authorized: The port is in Force Authorized or a single-supplicant mode and the
supplicant is authorized.
•
Unauthorized: The port is in Force Unauthorized or a single-supplicant mode and
the supplicant is not successfully authorized by the RADIUS server.
•
X Auth/Y Unauth: The port is in a multi-supplicant mode. Currently X clients
are authorized and Y are unauthorized.
Security | Network | NAS
Configuration Pages - 85
Advertisement
Table of Contents
