Vlan Assignment, Guest Vlan, Restricted Vlan, And Inaccessible Authentication Bypass - Cisco WS-C2960-24LC-S Software Configuration Manual

Chapter 9 Configuring IEEE 802.1x Port-Based Authentication
•
•

VLAN Assignment, Guest VLAN, Restricted VLAN, and Inaccessible Authentication Bypass

These are the configuration guidelines for VLAN assignment, guest VLAN, restricted VLAN, and
inaccessible authentication bypass:
•
•
•
•
•
OL-8603-04
The IEEE 802.1x protocol is supported on Layer 2 static-access ports and voice VLAN ports, but it
is not supported on these port types:
Trunk port—If you try to enable IEEE 802.1x authentication on a trunk port, an error message
–
appears, and IEEE 802.1x authentication is not enabled. If you try to change the mode of an
IEEE 802.1x-enabled port to trunk, an error message appears, and the port mode is not changed.
Dynamic ports—A port in dynamic mode can negotiate with its neighbor to become a trunk
–
port. If you try to enable IEEE 802.1x authentication on a dynamic port, an error message
appears, and IEEE 802.1x authentication is not enabled. If you try to change the mode of an
IEEE 802.1x-enabled port to dynamic, an error message appears, and the port mode is not
changed.
– Dynamic-access ports—If you try to enable IEEE 802.1x authentication on a dynamic-access
(VLAN Query Protocol [VQP]) port, an error message appears, and IEEE 802.1x authentication
is not enabled. If you try to change an IEEE 802.1x-enabled port to dynamic VLAN assignment,
an error message appears, and the VLAN configuration is not changed.
EtherChannel port—Do not configure a port that is an active or a not-yet-active member of an
–
EtherChannel as an IEEE 802.1x port. If you try to enable IEEE 802.1x authentication on an
EtherChannel port, an error message appears, and IEEE 802.1x authentication is not enabled.
Switched Port Analyzer (SPAN) and Remote SPAN (RSPAN) destination ports—You can
–
enable IEEE 802.1x authentication on a port that is a SPAN or RSPAN destination port.
However, IEEE 802.1x authentication is disabled until the port is removed as a SPAN or
RSPAN destination port. You can enable IEEE 802.1x authentication on a SPAN or RSPAN
source port.
Before globally enabling IEEE 802.1x authentication on a switch by entering the dot1x
system-auth-control global configuration command, remove the EtherChannel configuration from
the interfaces on which IEEE 802.1x authentication and EtherChannel are configured.
When IEEE 802.1x authentication is enabled on a port, you cannot configure a port VLAN that is
equal to a voice VLAN.
The IEEE 802.1x authentication with VLAN assignment feature is not supported on trunk ports,
dynamic ports, or with dynamic-access port assignment through a VMPS.
You can configure any VLAN except an RSPAN VLAN or a voice VLAN as an IEEE 802.1x guest
VLAN. The guest VLAN feature is not supported on trunk ports; it is supported only on access ports.
After you configure a guest VLAN for an IEEE 802.1x port to which a DHCP client is connected,
you might need to get a host IP address from a DHCP server. You can change the settings for
restarting the IEEE 802.1x authentication process on the switch before the DHCP process on the
client times out and tries to get a host IP address from the DHCP server. Decrease the settings for
the IEEE 802.1x authentication process (dot1x timeout quiet-period and dot1x timeout tx-period
interface configuration commands). The amount to decrease the settings depends on the connected
IEEE 802.1x client type.
When configuring the inaccessible authentication bypass feature, follow these guidelines:
The feature is supported on IEEE 802.1x port in single-host mode and multihosts mode.
–
If the client is running Windows XP and the port to which the client is connected is in the
–
critical-authentication state, Windows XP might report that the interface is not authenticated.
Configuring IEEE 802.1x Authentication
Catalyst 2960 Switch Software Configuration Guide
9-21