75
Auth-Fail VLAN
The Auth-Fail VLAN feature allows users failing authentication to access a specified VLAN, which
is called the Auth-Fail VLAN. Note that failing authentication means being denied by the
authentication server due to reasons such as wrong password. Authentication failures caused by
authentication timeout or network connection problems do not fall into this category.
Currently, the switch supports port-based Auth-Fail VLAN (PAFV) only.
PAFV refers to the Auth-Fail VLAN configured on a port that uses the port-based access control
method. With PAFV configured on a port, if a user on the port fails authentication, the port will be
added to the Auth-Fail VLAN and all users accessing the port will be authorized to access the
resources in the Auth-Fail VLAN. The switch adds a PAFV-configured port into the Auth-Fail VLAN
according to the port’s link type in the similar way as described in
If a user of a port in the Auth-Fail VLAN initiates authentication but fails the authentication, the port
stays in the Auth-Fail VLAN. If the user passes the authentication successfully, the port leaves the
Auth-Fail VLAN, and:
•
If the authentication server assigns a VLAN, the port joins the assigned VLAN. After the user
logs off, the port returns to its initial VLAN, that is, the VLAN the port was in before it was
added to any authorized VLAN.
•
If the authentication server assigns no VLAN, the port returns to its initial VLAN. After the
client logs off, the port still stays in its initial VLAN.
If the user initiates authentication again and passes the authentication, the switch will add the user
to the assigned VLAN or return the user to the initial VLAN of the port, depending on whether the
authentication server assigns a VLAN.
Mandatory authentication domain for a specified port
The mandatory authentication domain function provides a security control mechanism for 802.1X
access. With a mandatory authentication domain specified for a port, the system uses the
mandatory authentication domain for authentication, authorization, and accounting of all 802.1X
users on the port. In this way, users accessing the port cannot use any account in other domains.
Meanwhile, for EAP relay mode 802.1X authentication that uses certificates, the certificate of a
user determines the authentication domain of the user. However, you can specify different
mandatory authentication domains for different ports even if the user certificates are from the same
certificate authority (that is, the user domain names are the same). This allows you to deploy
802.1X access policies flexibly.
802.1X basic configuration
Configuration prerequisites
802.1X provides a method for implementing user identity authentication. However, 802.1X cannot
implement the authentication scheme solely by itself. RADIUS or local authentication must be
configured to work with 802.1X.
•
Configure the ISP domain to which the 802.1X user belongs and the AAA scheme to be used
(that is, local authentication or RADIUS).
