5-25
Configuring Port-Based Access Control (802.1x)
How 802.1x Authentication Affects VLAN Operation
an untagged member of another VLAN, port "N" loses access to that other
VLAN for the duration of the session. (This is because a port can be an
untagged member of only one VLAN at a time.)
For example, suppose that a RADIUS-authenticated, 802.1x-aware client on
port A2 requires access to VLAN 22, but VLAN 22 is configured for no access
on port A2, and VLAN 33 is configured as untagged on port A2:
Figure 5-5. Example of an Active VLAN Configuration
In figure 5-5, if RADIUS authorizes an 802.1x client on port 2 with the
requirement that the client use VLAN 22, then:
VLAN 22 becomes available as Untagged on port 2 for the duration of
the session.
VLAN 33 becomes unavailable to port 2 for the duration of the session
(because there can be only one untagged VLAN on any port).
You can use the show vlan < vlan-id > command to view this temporary change
to the active configuration, as shown below:
You can see the temporary VLAN assignment by using the show vlan
< vlan-id > command with the < vlan-id > of the static VLAN that the
authenticated client is using.
Scenario: An
authorized 802.1x
client requires access
to VLAN 22 from port
A2. However, access
to VLAN 22 is blocked
(not untagged or
tagged) on port A2 and
!FishSecurity.book Page 25 Thursday, October 10, 2002 9:19 PM
To Next Page
Loading...
Need help?
General
