Administrator Guide

If the supplicant fails to authenticate for a specied number of times, the authenticator typically does not enable the port. In some cases
this behavior is not appropriate. External users of an enterprise network, for example, might not be able to be authenticated, but still need
access to the network. Also, some dumb-terminals, such as network printers, do not have 802.1X capability and therefore cannot
authenticate themselves. To be able to connect such devices, they must be allowed access the network without compromising network
security.
The Guest VLAN 802.1X extension addresses this limitation with regard to non-802.1X capable devices and the Authentication-fail VLAN
802.1X extension addresses this limitation with regard to external users.
• If the supplicant fails authentication a specied number of times, the authenticator places the port in the Authentication-fail VLAN.
• If a port is already forwarding on the Guest VLAN when 802.1X is enabled, the port is moved out of the Guest VLAN and the
authentication process begins.
Conguring a Guest VLAN
If the supplicant does not respond within a determined amount of time ([reauth-max + 1] * tx-period, the system assumes that the host
does not have 802.1X capability and the port is placed in the Guest VLAN.
NOTE: For more information about conguring timeouts, see Conguring Timeouts.
Congure a port to be placed in the Guest VLAN after failing to respond within the timeout period using the dot1x guest-vlan
command from INTERFACE mode. View your conguration using the show config command from INTERFACE mode or using the show
dot1x interface
command from EXEC Privilege mode.
Example of Viewing Congured Authentication
The following examples shows you how to view the congured authentication using the show configuration command in Interface
mode.
Dell(conf-if-Te-2/1)#dot1x guest-vlan 200
Dell(conf-if-Te 2/1))#show config
!
interface TenGigabitEthernet 21
switchport
dot1x guest-vlan 200
no shutdown
Dell(conf-if-Te 2/1))#show config
802.1x information on Te 2/1:
-----------------------------
Dot1x Status: Enable
Port Control: FORCE_AUTHORIZED
Port Auth Status: UNAUTHORIZED
Re-Authentication: Disable
Untagged VLAN id: 200
Guest VLAN: Enabled
Guest VLAN id: 200
Auth-Fail VLAN: Disabled
Auth-Fail VLAN id: NONE
Auth-Fail Max-Attempts: 5
Tx Period: 90 seconds
Quiet Period: 120 seconds
ReAuth Max: 10
Supplicant Timeout: 15 seconds
Server Timeout: 15 seconds
Re-Auth Interval: 7200 seconds
Max-EAP-Req: 10
Auth Type: SINGLE_HOST
Auth PAE State: Initialize
Backend State: Initialize
802.1X
103