802.1x Overview 725
■ If the port link type is Hybrid, the assigned VLAN is allowed to pass the current
port without carrying the tag. The default VLAN ID of the port is that of the
assigned VLAN.
The assigned VLAN neither changes nor affects the configuration of a port.
However, as the assigned VLAN has higher priority than the user-configured VLAN,
it is the assigned VLAN that takes effect after a user passes authentication. After
the user goes offline, the port returns to its original VLAN.
For details about VLAN configuration, refer to “VLAN Configuration” on page 83.
n
■ With a Hybrid port, the VLAN assigning will fail if you have configured the
assigned VLAN to carry tags.
■ With a Hybrid port, you cannot configure an assigned VLAN to carry tags after
the VLAN has been assigned.
Guest VLAN
Guest VLAN allows unauthenticated users to access some special resources.
Guest VLAN is the default VLAN that a supplicant on a port can access without
authentication. After the supplicant passes 802.1x authentication, the port leaves
the guest VLAN and the supplicant can access other network resources.
A user of the guest VLAN can perform operations such as downloading and
upgrading the authentication client software. If a supplicant does not have the
required authentication client software or the version of the client software is
lower, the supplicant will fail the authentication. If no supplicant on a port passes
authentication in a certain period of time (45 seconds by default), the port will be
added into the guest VLAN.
If a device with 802.1x enabled and the guest VLAN correctly configured sends an
EAP-Request/Identity packet for the allowed maximum number of times but gets
no response, it adds the port into the guest VLAN according to port link type in
the similar way as described in VLAN assigning.
When a supplicant added into the guest VLAN initiates another authentication
process, if the authentication is not successful, the supplicant stays in the guest
VLAN; otherwise, two cases may occur:
■ The authentication server assigns a VLAN: The port leaves the guest VLAN and
joins the assigned VLAN. If the supplicant goes offline, the port returns to its
original VLAN, that is, the VLAN to which it is configured to belong and it
belongs before joining the guest VLAN.
■ The authentication server does not assign any VLAN: The port leaves the guest
VLAN and returns to its original VLAN. If the supplicant goes offline, the port
just stays in its original VLAN.
ACL assignment
ACLs provide a way of controlling access to network resources and defining access
rights. When a user logs in through a port, and the RADIUS server is configured
with authorization ACLs, the device will permit or deny data flows traversing
through the port according to the authorization ACLs. Before specifying
authorization ACLs on the server, you need to configure the ACL rules on the
To Next Page
Loading...
