Cisco Sx350

802.1X Commands
91 Cisco Sx350 Ph. 2.2.5 Devices - Command Line Interface Reference Guide
3
The single-host mode manages the authentication status of the port: the port is
authorized if there is an authorized host. In this mode, only a single host can be
authorized on the port.
When a port is unauthorized and the guest VLAN is enabled, untagged traffic is
remapped to the guest VLAN. Tagged traffic is dropped unless the VLAN tag is the
guest VLAN or the unauthenticated VLANs. If guest VLAN is not enabled on the
port, only tagged traffic belonging to the unauthenticated VLANs is bridged.
When a port is authorized, untagged and tagged traffic from the authorized host is
bridged based on the static vlan membership configured at the port. Traffic from
other hosts is dropped.
A user can specify that untagged traffic from the authorized host will be
remapped to a VLAN that is assigned by a RADIUS server during the
authentication process. In this case, tagged traffic is dropped unless the VLAN tag
is the RADIUS-assigned VLAN or the unauthenticated VLANs. See the dot1x
radius-attributes vlan command to enable RADIUS VLAN assignment at a port.
The switch removes from FDB all MAC addresses learned on a port when its
authentication status is changed from authorized to unauthorized.
Multi-Host Mode
The multi-host mode manages the authentication status of the port: the port is
authorized after at least one host is authorized.
When a port is unauthorized and the guest VLAN is enabled, untagged traffic is
remapped to the guest VLAN. Tagged traffic is dropped unless the VLAN tag is the
guest VLAN or the unauthenticated VLANs. If guest VLAN is not enabled on the
port, only tagged traffic belonging to the unauthenticated VLANs is bridged.
When a port is authorized, untagged and tagged traffic from all hosts connected to
the port is bridged based on the static vlan membership configured at the port.
A user can specify that untagged traffic from the authorized port will be
remapped to a VLAN that is assigned by a RADIUS server during the
authentication process. In this case, tagged traffic is dropped unless the VLAN tag
is the RADIUS assigned VLAN or the unauthenticated VLANs. See the dot1x
radius-attributes vlan command to enable RADIUS VLAN assignment at a port.
The switch removes from FDB all MAC addresses learned on a port when its
authentication status is changed from authorized to unauthorized.
Multi-Sessions Mode
Unlike the single-host and multi-host modes (port-based modes) the
multi-sessions mode manages the authentication status for each host connected
to the port (session-based mode). If the multi-sessions mode is configured on a
port the port does have any authentication status. Any number of hosts can be