Dell N3200-ON EMC Networking N-Series Switches CLI Reference Guide version 6.7 - Page 949

MAC Authentication Bypass (MAB) provides 802.1x unaware clients controlled access to the network using the devices' MAC address as an identifier. This requires that the known and allowable MAC address and corresponding access rights be prepopulated in the authentication server. Port access by MAB clients is allowed via local authentication if the user database has corresponding entries added for the MAB clients with user name and password attributes set to the MAC address of MAB clients. Alternatively, a RADIUS authentication server can be configured with the MAC addresses of the MAB clients. In this configuration, the switch uses EAP-MD5, CHAP, and PAP authentication to communicate with the authentication server. No other authentication or privacy protocol is supported for server side authentication. Guest VLAN The Guest VLAN feature allows a Dell EMC Networking switch to provide a distinguished service to unauthenticated network devices (not rogue devices that fail authentication). This feature provides a mechanism to allow network devices to have network access to reach an external network while restricting their ability to access the internal LAN. When a client that does not support 802.1x is connected to an unauthorized port that is 802.1x-enabled, the client does not respond to the 802.1x requests from the switch. The port remains in the unauthorized state and the client is not granted access to the network. If a guest VLAN is configured for that port, then the client is placed in the configured guest VLAN, and the client is moved to the authorized state, allowing network access to the client over the guest VLAN. RADIUS accounting records are not transmitted for 802.1X client placed into guest VLAN. Authentication is periodically re-attempted for hosts placed into the guest VLAN. The re-authentication period is calculated as follows: Re-authentication period = (max-reauth-req + 1) × tx-period The max-reauth-req and tx-period are configured using the following commands: • dot1x max-reauth-req • dot1x timeout tx-period. See dot1x timeout. Security Commands 949