85
command to view the connection information of the user. If the user fails the RADIUS
authentication, local authentication of the user will be performed.
Guest VLAN and VLAN assignment
configuration example
Network requirements
•
A host is connected to port GigabitEthernet 3/0/2 of the switch and must pass 802.1X
authentication to access the Internet. GigabitEthernet 3/0/2 is in VLAN 1.
•
The authentication server runs RADIUS and is in VLAN 2.
•
The update server, which is in VLAN 10, is for client software download and upgrade.
•
Port GigabitEthernet 3/0/3 of the switch, which is in VLAN 5, is for accessing the Internet.
•
On port GigabitEthernet 3/0/2, enable 802.1X and set VLAN 10 as the guest VLAN of the
port. If the number of attempts of the switch for sending EAP-Request/Identity messages from
GigabitEthernet 3/0/2 exceeds the upper limit but the switch does not receive any
responses, the switch adds the port to its guest VLAN. In this case, the host and the update
server are both in VLAN 10, so that the host can access the update server and download the
802.1X client.
•
After the host passes the authentication and logs on, the host is added to VLAN 5. In this
case, the host and GigabitEthernet 3/0/3 are both in VLAN 5, so that the host can access
the Internet.
Figure 24
Network diagram for guest VLAN configuration
Internet
Update server
Authentication server
Host
VLAN 10
GE3/0/1
VLAN 1
GE3/0/2
VLAN 5
GE3/0/3
VLAN 2
GE3/0/4
Device
