Netgear XCM8810 Chassis Hardware Installation Guide - Page 691

NETGEAR 8800 Chassis Switch CLI Manual • Configure guest VLANs only on network login ports with 802.1x enabled. • Movement to guest VLANs is not supported on network login ports with MAC-based or web-based authentication. • 802.1x must be the only authentication method enabled on the port for movement to guest VLAN. • No supplicant on the port has 802.1x capability. • You configure only one guest VLAN per virtual router interface. Note: The supplicant does not move to a guest VLAN if it fails authentication after an 802.1x exchange; the supplicant moves to the guest VLAN only if it does not respond to an 802.1x authentication request. Modifying the Supplicant Timer By default, the switch attempts to authenticate the supplicant every 30 seconds for a maximum of three tries. If the supplicant does not respond to the authentication requests, the client moves to the guest VLAN. The number of authentication attempts is not a user-configured parameter. To modify the supplicant response timer, use the following command and specify the supp-resp-timeout parameter: configure netlogin dot1x timers [{server-timeout } {quiet-period } {reauth-period {reauth-max }} {supp-resp-timeout }] If a supplicant on a port in the guest VLAN becomes 802.1x-capable, the switch starts processing the 802.1x responses from the supplicant. If the supplicant is successfully authenticated, the port moves from the guest VLAN to the destination VLAN specified by the RADIUS server. Enabling Guest VLANs To enable the guest VLAN, use the following command: enable netlogin dot1x guest-vlan ports [all | ] Example The following command creates a guest VLAN for 802.1x named guest for all ports: configure netlogin dot1x guest-vlan guest The following command creates a guest VLAN named guest for ports 2 and 3: configure netlogin dot1x guest-vlan guest ports 2,3 Chapter 16. Network Login Commands | 691