Cisco WS-C6506 Software Manual page 1033

Chapter 40 Configuring 802.1X Authentication
•
•
•
•
Creating an Authentication Failure VLAN and Adding 802.1X Ports
To create an authentication failure VLAN and add 802.1X ports to the VLAN, perform this task in
privileged mode:
Task
Create an authentication failure VLAN and add
802.1X ports to the VLAN.
This example shows how to create the authentication failure VLAN (VLAN 81) and add port 3/33:
Console> (enable) set port dot1x 3/33 auth-fail-vlan 81
Port 3/33 Auth Fail Vlan is set to 81
Console> (enable)
This example shows how to display the authentication failure VLAN configuration:
Console> (enable) show port dot1x auth-fail-vlan
Auth-Fail-Vlan Status
-------------- -------- ------------------
81
none
Console> (enable)
This example shows how to clear a port from an authentication failure VLAN:
Console> (enable) set port dot1x 3/33 auth-fail-vlan none
Port 3/33 Auth Fail Vlan is cleared
Console> (enable)
This example shows how to list the active users and ports in an authentication failure VLAN:
Console> (enable) show dot1x auth-fail-users
Username
--------
testuser
Console> (enable)
OL-8978-04
On multiple VLAN access ports (MVAPs), the authentication failure VLAN and the auxiliary VLAN
cannot be the same VLAN.
The authentication failure VLAN and port security features do not conflict with each other. Additionally,
other security features, such as Dynamic ARP Inspection (DAI), Dynamic Host Configuration
Protocol (DHCP) snooping, and IP source guard can be enabled and disabled independently on the
authentication failure VLAN.
An authentication failure VLAN is independent of a guest VLAN. However, the guest VLAN can
be the same VLAN as the authentication failure VLAN. If you do not want to differentiate between
the non-802.1X capable hosts and the authentication failed hosts, you may configure both hosts to the
same VLAN (either a guest VLAN or an authentication failure VLAN).
High availability is supported with an authentication failure VLAN.
Mod/Ports
active 3/33
none 1/1-2,2/1-2,3/1-32,3/34-48
Mod/Port
--------
3/33
Command
set port dot1x mod/ports auth-fail-vlan {none |
vlan}
Auth-Fail-Vlan
--------------
81
Catalyst 6500 Series Switch Software Configuration Guide—Release 8.7
Configuring 802.1X Authentication on the Switch
40-39