Administrator Guide

Security Commands 1011
Command Mode
Interface Configuration (Ethernet) mode
User Guidelines
It is recommended that the user set the dot1x timeout guest-vlan-period to at
least three times the dot1x timeout tx-period timer so that at least three EAP
Requests are sent, before assuming that the client is an 802.1X unaware
client. An 802.1X unaware client is one that does not respond to EAP-
Request/Identity frames and does not send EAPOL-Start or EAP-
Response/Identity frames.
Example
The following example sets the 802.1X timeout guest vlan period to 100
seconds.
console(config)# dot1x timeout guest-vlan-period 100
dot1x unauth-vlan
Use the dot1x unauth-vlan command in Interface Configuration mode to
specify the unauthenticated VLAN on a port. The unauthenticated VLAN is
the VLAN to which supplicants that fail 802.1x authentication are assigned.
Syntax
dot1x unauth-vlan vlan-id
no dot1x unauth-vlan
• vlan-id — The ID of a valid VLAN to use for unauthenticated clients
(Range: 1-4093).
Default Configuration
The unauthenticated VLAN is disabled on the interface by default.
Command Mode
Interface Configuration (Ethernet) mode