Dell C1048P Port Extender Networking Configuration Guide for the C9000 Series - Page 96

If the supplicant fails to authenticate for a specified number of times, the authenticator typically does not enable the port. In some cases this behavior is not appropriate. External users of an enterprise network, for example, might not be able to be authenticated, but still need access to the network. Also, some dumb-terminals, such as network printers, do not have 802.1X capability and therefore cannot authenticate themselves. To be able to connect such devices, they must be allowed access the network without compromising network security. The Guest VLAN 802.1X extension addresses this limitation with regard to non-802.1X capable devices and the Authenticationfail VLAN 802.1X extension addresses this limitation with regard to external users. • If the supplicant fails authentication a specified number of times, the authenticator places the port in the Authentication-fail VLAN. • If a port is already forwarding on the Guest VLAN when 802.1X is enabled, the port is moved out of the Guest VLAN and the authentication process begins. Configuring a Guest VLAN If the supplicant does not respond within a determined amount of time ([reauth-max + 1] * tx-period, the system assumes that the host does not have 802.1X capability and the port is placed in the Guest VLAN. NOTE: For more information about configuring timeouts, see Configuring Timeouts. Configure a port to be placed in the Guest VLAN after failing to respond within the timeout period using the dot1x guestvlan command from INTERFACE mode. View your configuration using the show config command from INTERFACE mode or using the show dot1x interface command from EXEC Privilege mode. Example of Viewing Configured Authentication The following examples shows you how to view the configured authentication using the show configuration command in Interface mode. Dell(conf-if-Te-2/1)#dot1x guest-vlan 200 Dell(conf-if-Te 2/1))#show config ! interface TenGigabitEthernet 21 switchport dot1x guest-vlan 200 no shutdown Dell(conf-if-Te 2/1))#show config 802.1x information on Te 2/1: Dot1x Status: Enable Port Control: FORCE_AUTHORIZED Port Auth Status: UNAUTHORIZED Re-Authentication: Disable Untagged VLAN id: 200 Guest VLAN: Enabled Guest VLAN id: 200 Auth-Fail VLAN: Disabled Auth-Fail VLAN id: NONE Auth-Fail Max-Attempts: 5 Tx Period: 90 seconds Quiet Period: 120 seconds ReAuth Max: 10 Supplicant Timeout: 15 seconds Server Timeout: 15 seconds Re-Auth Interval: 7200 seconds Max-EAP-Req: 10 Auth Type: SINGLE_HOST Auth PAE State: Initialize Backend State: Initialize 802.1X 96