Dell PowerConnect 8100 User's Configuration Guide - Page 473

NOTE: MAB initiates only after the dot1x guest VLAN period times out. If the client responds to any of the EAPOL identity requests, MAB does not initiate for that client. What is the Role of 802.1X in VLAN Assignment? PowerConnect 8000/8100-series switches allow a port to be placed into a particular VLAN based on the result of the authentication or type of 802.1X authentication a client uses when it accesses the switch. The authentication server can provide information to the switch about which VLAN to assign the supplicant. When a host connects to a switch that uses an authentication server to authenticate, the host authentication can typically have one of three outcomes: • The host is authenticated. • The host attempts to authenticate but fails because it lacks certain security credentials. • The host is a guest and does not try to authenticate at all (802.1X unaware). You can create three separate VLANs on the switch to handle a host depending on whether the host authenticates, fails the authentication, or is a guest. The RADIUS server informs the switch of the selected VLAN as part of the authentication. Authenticated and Unauthenticated VLANs Hosts that authenticate normally use a VLAN that includes access to network resources. Hosts that fail the authentication might be denied access to the network or placed on a quarantine VLAN with limited network access. Much of the configuration to assign authenticated hosts to a particular VLAN takes place on the 802.1X authenticator server (for example, a RADIUS server). If you use an external RADIUS server to manage VLANs, you configure the server to use Tunnel attributes in Access-Accept messages in order to inform the switch about the selected VLAN. These attributes are defined in RFC 2868, and their use for dynamic VLAN is specified in RFC 3580. Configuring Port and System Security 473