Authentication status

VLAN manipulation

No 802.1X user has

The device assigns the 802.1X guest VLAN to the port as the PVID. All

performed authentication

802.1X users on this port can access only resources in the guest VLAN.

within 90 seconds after

If no 802.1X guest VLAN is configured, the access device does not

802.1X is enabled.

perform any VLAN operation.

 

 

 

If an 802.1X Auth-Fail VLAN (see "Auth-Fail VLAN") is available, the

A user in the 802.1X guest

device assigns the Auth-Fail VLAN to the port as the PVID. All users on this

VLAN fails 802.1X

port can access only resources in the Auth-Fail VLAN.

authentication.

If no Auth-Fail VLAN is configured, the PVID on the port is still the 802.1X

 

guest VLAN. All users on the port are in the guest VLAN.

 

 

 

• The device assigns the VLAN specified for the user to the port as the

 

PVID, and removes the port from the 802.1X guest VLAN. After the

A user in the 802.1X guest

user logs off, the user configured PVID restores.

VLAN passes 802.1X

• If the authentication server assigns no VLAN, the user configured PVID

authentication.

applies. The user and all subsequent 802.1X users are assigned to the

 

user-configured PVID. After the user logs off, the PVID remains

 

unchanged.

 

 

•On a port that performs MAC-based access control:

Authentication status

VLAN manipulation

A user has not passed

The device creates a mapping between the MAC address of the user and

the 802.1X guest VLAN. The user can access resources in the guest

802.1X authentication yet.

VLAN.

 

 

 

 

If an 802.1X Auth-Fail VLAN is available, the device remaps the MAC

A user in the 802.1X guest

address of the user to the Auth-Fail VLAN. The user can access only

VLAN fails 802.1X

resources in the Auth-Fail VLAN.

authentication.

If no 802.1X Auth-Fail VLAN is configured, the user is still in the guest

 

VLAN.

A user in the 802.1X guest VLAN passes 802.1X authentication.

The device remaps the MAC address of the user to the authorized VLAN.

If the authentication server assigns no authorized VLAN, the device remaps the MAC address of the user to the initial PVID on the port.

To use the 802.1X guest VLAN function on a port that performs MAC-based access control, make sure the port is a hybrid port, and enable MAC-based VLAN on the port.

The network device assigns a hybrid port to an 802.1X guest VLAN as an untagged member.

Auth-Fail VLAN

You can configure an Auth-Fail VLAN to accommodate users that have failed 802.1X authentication because of the failure to comply with the organization security strategy, such as using a wrong password. Users in the Auth-Fail VLAN can access a limited set of network resources, such as a software server, to download anti-virus software and system patches.

The Auth-Fail VLAN does not accommodate 802.1X users that have failed authentication for authentication timeouts or network connection problems. The way that the network access device handles VLANs on the port differs by 802.1X access control mode.

•On a port that performs port-based access control:

330