Guest And Authentication-Fail Vlans; Configuring A Guest Vlan - Dell Force10 C150 Configuration Manual

Guest and Authentication-Fail VLANs

Typically, the authenticator (Dell Force10 system) denies the supplicant access to the network until the
supplicant is authenticated. If the supplicant is authenticated, the authenticator enables the port and places
it in either the VLAN for which the port is configured, or the VLAN that the authentication server indicates
in the authentication data.
Note: Ports cannot be dynamically assigned to the default VLAN.
If the supplicant fails authentication, the authenticator typically does not enable the port. In some cases this
behavior is not appropriate. External users of an enterprise network, for example, might not be able to be
authenticated, but still need access to the network. Also, some dumb-terminals such as network printers do
not have 802.1X capability and therefore cannot authenticate themselves. To be able to connect such
devices, they must be allowed access the network without compromising network security.
The Guest VLAN 802.1X extension addresses this limitation with regard to non-802.1X capable devices,
and the Authentication-fail VLAN 802.1X extension addresses this limitation with regard to external users.
• If the supplicant fails authentication a specified number of times, the authenticator places the port in
the Authentication-fail VLAN.
• If a port is already forwarding on the Guest VLAN when 802.1X is enabled, then the port is moved out
of the Guest VLAN, and the authentication process begins.

Configuring a Guest VLAN

If the supplicant does not respond to a Request Identity frame within a determined amount of time
([ + 1] *
reauth-max
assumes that the host does not have 802.1X capability, and the port is placed in the Guest VLAN.
Configure a port to be placed in the Guest VLAN after failing to respond within the timeout period using
dot1x guest-vlan
the command
Figure 7-12. Configuring a Guest VLAN
FTOS(conf-if-gi-1/2)#dot1x guest-vlan 200
FTOS(conf-if-gi-1/2)#show config
!
interface GigabitEthernet 1/2
switchport
dot1x guest-vlan 200
no shutdown
FTOS(conf-if-gi-1/2)#
View your configuration using the command
Figure 7-12, or using the command
in Figure 7-14.
, see Configuring Request Identity Re-transmissions on page
tx-period
from INTERFACE mode, as shown in
show dot1x interface
show config
from INTERFACE mode, as shown in
command from EXEC Privilege mode as shown
114) the system
Figure 7-12.
802.1X | 121