To Next Page

To Previous Page

Network Login

ExtremeWare XOS 11.3 Concepts Guide

362

With a guest VLAN configured, if a supplicant does not have 802.1x enabled and does not respond to

802.1x authentication requests sent by the switch, the supplicant moves to a guest VLAN. Upon

entering the guest VLAN, the supplicant gains limited network access. You configure the amount of

network access granted to clients in the guest VLAN. If a supplicant responds to 802.1x authentication

requests, the supplicant gains network accesses based on its credentials.

NOTE

The supplicant does not move to a guest VLAN if it fails authentication after an 802.1x exchange; the supplicant

moves to the guest VLAN only if it does not respond to an 802.1x authentication request.

Suppose you have a meeting that includes company employees and visitors from outside the company.

In this scenario, your employees have 802.1x enabled supplicants (clients) but your visitors do not. By

configuring a guest VLAN, when your employees log into the network, they are granted network access

(based on their user credentials and 802.1x enabled clients). However, when the visitors attempt to log

into the network, they are granted limited network access because they do not have 802.1x enabled

clients. The visitors might be able to reach the Internet, but they are unable to access your network.

By default, the switch uses the supplicant response timer and attempts to authenticate the supplicant

every 30 seconds for a maximum of three tries. If the supplicant does not respond to the authentication

requests, the supplicant moves to the guest VLAN. The number of authentication attempts is not a user-

configured parameter.

The port moves out of the guest VLAN if, during subsequent authentications, the port is successfully

authenticated and the RADIUS server indicates a different VLAN to move to.

This section contains the following topics:

● Creating a Guest VLAN on page 362

● Enabling a Guest VLAN on page 362

● Modifying the Supplicant Response Timer on page 363

● Disabling a Guest VLAN on page 363

Creating a Guest VLAN

To create a guest VLAN, use the following command:

configure netlogin dot1x guest-vlan <vlan_name>

NOTE

You configure only one guest VLAN per virtual router (VR).

Enabling a Guest VLAN

To enable the guest VLAN, use the following command:

enable netlogin dot1x guest-vlan ports [all | <ports>]

Extreme Networks ExtremeWare XOS Guide User Manual

Questions and Answers: