Name: Cisco Catalyst 3750-X
Brand: Cisco
Rating: 5 (1 reviews)

To Next Page

To Previous Page

2-177

Catalyst 3750-X and 3560-X Switch Command Reference

OL-29704-01

Chapter 2 Catalyst 3750-X and 3560-X Switch Cisco IOS Commands

dot1x auth-fail vlan

You cannot configure a VLAN to be both a restricted VLAN and a voice VLAN. If you do this, a syslog

message is generated.

When a restricted VLAN port is moved to an unauthorized state, the authentication process restarts. If

the supplicant fails the authentication process again, the authenticator waits in the held state. After the

supplicant has correctly re-authenticated, all IEEE 802.1x ports are reinitialized and treated as normal

IEEE 802.1x ports.

When you reconfigure a restricted VLAN as a different VLAN, any ports in the restricted VLAN are also

moved, and the ports stay in their currently authorized state.

When you shut down or remove a restricted VLAN from the VLAN database, any ports in the restricted

VLAN are immediately moved to an unauthorized state, and the authentication process restarts. The

authenticator does not wait in a held state because the restricted VLAN configuration still exists. While

the restricted VLAN is inactive, all authentication attempts are counted so that when the restricted

VLAN becomes active, the port is immediately placed in the restricted VLAN.

The restricted VLAN is supported only in single host mode (the default port mode). For this reason,

when a port is placed in a restricted VLAN, the supplicant’s MAC address is added to the MAC address

table, and any other MAC address that appears on the port is treated as a security violation.

Examples This example shows how to configure a restricted VLAN on port 1:

Switch# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config)# interface gigabitethernet1/0/1

Switch(config-if)# dot1x auth-fail vlan 40

Switch(config-if)# end

Switch(config)# end

Switch#

You can verify your configuration by entering the show dot1x [interface interface-id] privileged EXEC

command.

Related Commands Command Description

dot1x auth-fail max-attempts

[max-attempts]

Configures the number of authentication attempts allowed

before assigning a supplicant to the restricted VLAN.

show dot1x [interface interface-id] Displays IEEE 802.1x status for the specified port.

Other manuals for Cisco Catalyst 3750-X

Questions and Answers:

Need help?

Do you have a question about the Cisco Catalyst 3750-X and is the answer not in the manual?

General