Administrator Guide

ManualsBrandsDell ManualsAccess PlatformsC9010 Modular Chassis Switch

100

● If a port is already forwarding on the Guest VLAN when 802.1X is enabled, the port is moved out of the Guest VLAN and the

authentication process begins.

Configuring a Guest VLAN

If the supplicant does not respond within a determined amount of time ([reauth-max + 1] * tx-period, the system assumes that

the host does not have 802.1X capability and the port is placed in the Guest VLAN.

NOTE: For more information about configuring timeouts, see Configuring Timeouts.

Configure a port to be placed in the Guest VLAN after failing to respond within the timeout period using the dot1x guest-

vlan command from INTERFACE mode. View your configuration using the show config command from INTERFACE mode or

using the show dot1x interface command from EXEC Privilege mode.

Example of Viewing Configured Authentication

The following examples shows you how to view the configured authentication using the show configuration command in

Interface mode.

Dell(conf-if-Te-2/1)#dot1x guest-vlan 200

Dell(conf-if-Te 2/1))#show config

interface TenGigabitEthernet 21

switchport

dot1x guest-vlan 200

no shutdown

Dell(conf-if-Te 2/1))#show config

802.1x information on Te 2/1:

-----------------------------

Dot1x Status: Enable

Port Control: FORCE_AUTHORIZED

Port Auth Status: UNAUTHORIZED

Re-Authentication: Disable

Untagged VLAN id: 200

Guest VLAN: Enabled

Guest VLAN id: 200

Auth-Fail VLAN: Disabled

Auth-Fail VLAN id: NONE

Auth-Fail Max-Attempts: 5

Tx Period: 90 seconds

Quiet Period: 120 seconds

ReAuth Max: 10

Supplicant Timeout: 15 seconds

Server Timeout: 15 seconds

Re-Auth Interval: 7200 seconds

Max-EAP-Req: 10

Auth Type: SINGLE_HOST

Auth PAE State: Initialize

Backend State: Initialize

Configuring an Authentication-Fail VLAN

If the supplicant fails authentication, the authenticator re-attempts to authenticate after a specified amount of time.

NOTE:

For more information about authenticator re-attempts, refer to Configuring a Quiet Period after a Failed

Authentication.

You can configure the maximum number of times the authenticator re-attempts authentication after a failure (3 by default),

after which the port is placed in the Authentication-fail VLAN.

Configure a port to be placed in the VLAN after failing the authentication process as specified number of times using the dot1x

auth-fail-vlan command from INTERFACE mode. Configure the maximum number of authentication attempts by the

authenticator using the keyword max-attempts with this command.

802.1X