Extreme Networks ExtremeWare XOS 11.3, Manual

Page: 362 / 698

Network Login
ExtremeWare XOS 11.3 Concepts Guide
362
With a guest VLAN configured, if a supplicant does not have 802.1x enabled and does not respond to
802.1x authentication requests sent by the switch, the supplicant moves to a guest VLAN. Upon
entering the guest VLAN, the supplicant gains limited network access. You configure the amount of
network access granted to clients in the guest VLAN. If a supplicant responds to 802.1x authentication
requests, the supplicant gains network accesses based on its credentials.
NOTE
The supplicant does not move to a guest VLAN if it fails authentication after an 802.1x exchange; the supplicant
moves to the guest VLAN only if it does not respond to an 802.1x authentication request.
Suppose you have a meeting that includes company employees and visitors from outside the company.
In this scenario, your employees have 802.1x enabled supplicants (clients) but your visitors do not. By
configuring a guest VLAN, when your employees log into the network, they are granted network access
(based on their user credentials and 802.1x enabled clients). However, when the visitors attempt to log
into the network, they are granted limited network access because they do not have 802.1x enabled
clients. The visitors might be able to reach the Internet, but they are unable to access your network.
By default, the switch uses the supplicant response timer and attempts to authenticate the supplicant
every 30 seconds for a maximum of three tries. If the supplicant does not respond to the authentication
requests, the supplicant moves to the guest VLAN. The number of authentication attempts is not a user-
configured parameter.
The port moves out of the guest VLAN if, during subsequent authentications, the port is successfully
authenticated and the RADIUS server indicates a different VLAN to move to.
This section contains the following topics:
●
Creating a Guest VLAN on page 362
●
Enabling a Guest VLAN on page 362
●
Modifying the Supplicant Response Timer on page 363
●
Disabling a Guest VLAN on page 363
Creating a Guest VLAN
To create a guest VLAN, use the following command:
configure netlogin dot1x guest-vlan <vlan_name>
NOTE
You configure only one guest VLAN per virtual router (VR).
Enabling a Guest VLAN
To enable the guest VLAN, use the following command:
enable netlogin dot1x guest-vlan ports [all | <ports>]