Users Guide

Authentication, Authorization, and Accounting 363
Guest VLAN
The Guest VLAN feature provides a mechanism to allow hosts access to a
guest VLAN. For example, the administrator might provide a guest VLAN to
visitors and contractors to permit network access that allows visitors to
connect to external network resources, such as the Internet, with no ability to
access information on the internal LAN.
As an example, on a port configured in auto authentication mode
(authentication port-control auto) and connected to a host that does not
support 802.1X, the host does not respond to the 802.1X requests from the
switch. The port remains in the unauthorized state and the client is not
granted access to the network. If a guest VLAN is configured for that port, the
host is placed in the configured guest VLAN and moved to the authorized
state, allowing access to the client over the guest VLAN.
When the guest VLAN capability is disabled, hosts authorized by the guest
VLAN are removed from the VLAN and denied network access.
Authentication is periodically re-attempted for hosts placed into the guest
VLAN. The re-authentication period is calculated as follows:
Re-authentication period = (max-reauth-req + 1) × tx-period
The max-reauth-req and tx-period are configured using the following
commands:
• dot1x max-reauth-req
• dot1x timeout tx-period
RADIUS Trunk Mode Assignment
Some network administrators may choose to use a default configuration on all
ports in the network and administer bespoke network policies via RADIUS.
Dell EMC switches support configuration of switchport trunk mode on ports
NOTE: MAB and the guest VLAN feature are mutually exclusive on a port. If MAB
is enabled on a port concurrently with guest VLAN, the port will not move to the
authorized state.