Dell PowerConnect J-8216 Software Guide for JUNOS version 10.3 - Page 2331

Chapter 81: 802.1X and MAC RADIUS Authentication Overview Server fail fallback is triggered most often during reauthentication when the already configured and in-use RADIUS server becomes inaccessible. However, server fail fallback can also be triggered by an end device's first attempt at authentication through the RADIUS server. Server fail fallback allows you to specify that an end device be moved to a specified VLAN if the switch receives an EAPOL accept-reject message. The configured VLAN name overrides any attributes sent by the server. Related Documentation • 802.1X for J-EX Series Switches Overview on page 2253 • Example: Configuring 802.1X Authentication Options When the RADIUS Server is Unavailable to a J-EX Series Switch on page 2271 • Example: Setting Up 802.1X for Single Supplicant or Multiple Supplicant Configurations on a J-EX Series Switch on page 2290 • Configuring Server Fail Fallback (CLI Procedure) on page 2337 • Configuring 802.1X Interface Settings (CLI Procedure) on page 2331 Understanding Dynamic VLANs for 802.1X on J-EX Series Switches Dynamic VLANs, in conjunction with the 802.1X authentication process, provide secure access to the LAN for supplicants belonging to different VLANs on a single port. When this feature is configured, a supplicant becomes a member of a VLAN dynamically after 802.1X authentication is successful. Successful authentication requires that the VLAN ID or VLAN name exist on the switch and match the VLAN ID or VLAN name sent by the RADIUS server during authentication. If the VLAN does not exist, the supplicant is unauthenticated. If a guest VLAN is established, the unauthenticated supplicant is automatically moved to the guest VLAN. Related • Example: Setting Up 802.1X in Conference Rooms to Provide Internet Access to Documentation Corporate Visitors on a J-EX Series Switch on page 2276 • Understanding Guest VLANs for 802.1X on J-EX Series Switches on page 2259 Understanding Guest VLANs for 802.1X on J-EX Series Switches Guest VLANs, in conjunction with 802.1X authentication, provide secure access to the LAN for corporate guests and for supplicants who fail the 802.1X authentication process. When a corporate visitor attempts to authenticate on the LAN, and authentication fails, the visitor is moved to a guest VLAN. A guest VLAN typically provides access only to the Internet. A guest VLAN can also provide limited access to the LAN in cases when authentication fails for supplicants that are not visitors. When authentication fails, the switch receives an Access-Reject message for the client, and checks if a guest VLAN is configured on that port. If so, it moves that user alone to the guest VLAN. If the Access-reject message 2259