Users Guide

Security Commands 950
Unauthenticated VLAN
The Unauthenticated VLAN feature allows a Dell EMC Networking switch to
provide a distinguished service to unauthorized network devices that attempt
and fail authentication. This feature provides a mechanism to allow network
devices to have network access to an external network while restricting their
ability to access the internal LAN.
When a client network device that supports 802.1x is connected to an
unauthorized port that is 802.1x enabled with no unauthenticated VLAN
configured and the client attempts and fails to authenticate, the port remains
in the unauthorized state and the client is not granted access to the network.
If an unauthenticated VLAN is configured for the port and the 802.1x client
fails to authenticate for the configured number of attempts, the port is placed
in the authorized state on the unauthenticated VLAN and the client is
granted access to the network.
Authentication is periodically re-attempted for hosts placed into the
unauthenticated VLAN. The re-authentication period is calculated as follows:
Re-authentication period = (max-reauth-req + 1) × tx-period
The max-reauth-req and tx-period are configured using the following
commands:
• dot1x max-reauth-req
• dot1x timeout tx-period. See dot1x timeout.
aaa accounting
Use this command to configure an accounting method list for User Exec
sessions, user-executed commands or 802.1X or to enable accounting. The no
version of the command deletes the accounting method list.
Use the no form of the command to delete an accounting method list or
disable accounting.
Use either the aaa accounting dot1x default none or no aaa accounting
command to disable dot1x accounting.
Syntax
aaa accounting {exec | commands | dot1x} {default | list-name} {start-stop
| stop-only |none} {radius|tacacs|radius tacacs|tacacs radius}