Administrator Guide
The Guest VLAN 802.1X extension addresses this limitation with regard to non-802.1X capable devices and the Authentication-fail VLAN
802.1X extension addresses this limitation with regard to external users.
• If the supplicant fails authentication a specied number of times, the authenticator places the port in the Authentication-fail VLAN.
• If a port is already forwarding on the Guest VLAN when 802.1X is enabled, the port is moved out of the Guest VLAN and the
authentication process begins.
Conguring a Guest VLAN
If the supplicant does not respond within a determined amount of time ([reauth-max + 1] * tx-period, the system assumes that the host
does not have 802.1X capability and the port is placed in the Guest VLAN.
NOTE: For more information about conguring timeouts, refer to Conguring
Timeouts.
Congure a port to be placed in the Guest VLAN after failing to respond within the timeout period using the dot1x guest-vlan
command from INTERFACE mode. View your conguration using the show config command from INTERFACE mode or using the show
dot1x interface command from EXEC Privilege mode.
Example of Viewing Guest VLAN Conguration
Dell(conf-if-gi-2/1)#dot1x guest-vlan 200
Dell(conf-if-gi 2/1))#show config
!
interface GigabitEthernet 2/1
switchport
dot1x guest-vlan 200
no shutdown
Dell(conf-if-gi 2/1))#
Conguring an Authentication-Fail VLAN
If the supplicant fails authentication, the authenticator re-attempts to authenticate after a specied amount of time.
NOTE
: For more information about authenticator re-attempts, refer to Conguring a Quiet Period after a Failed
Authentication.
You can congure the maximum number of times the authenticator re-attempts authentication after a failure (3 by default), after which the
port is placed in the Authentication-fail VLAN.
Congure a port to be placed in the VLAN after failing the authentication process as specied number of times using the dot1x auth-
fail-vlan command from INTERFACE mode. Congure the maximum number of authentication attempts by the authenticator using
the keyword
max-attempts with this command.
Example of Conguring Maximum Authentication Attempts
Dell(conf-if-gi-2/1)#dot1x guest-vlan 200
Dell(conf-if-gi 2/1)#show config
!
interface GigabitEthernet 2/1
switchport
dot1x authentication
dot1x guest-vlan 200
no shutdown
Dell(conf-if-gi-2/1)#
Dell(conf-if-gi-2/1)#dot1x auth-fail-vlan 100 max-attempts 5
Dell(conf-if-gi-2/1)#show config
!
interface GigabitEthernet 2/1
switchport
dot1x authentication
802.1X
99