H3C H3C S5100-SI, Руководство по эксплуатации, Страница: 255 / 830

1-12
The guest VLAN function
The guest VLAN function enables supplicant systems that are not authenticated to access
network resources in a restrained way.
The guest VLAN function enables supplicant systems that do not have 802.1x client
installed to access specific network resources. It also enables supplicant systems that are
not authenticated to upgrade their 802.1x client programs.
With this function enabled:
z
The switch sends authentication triggering request (EAP-Request/Identity) packets to
all the 802.1x-enabled ports.
z
After the maximum number retries have been made and there are still ports that have
not sent any response back, the switch will then add these ports to the guest VLAN.
z
Users belonging to the guest VLAN can access the resources of the guest VLAN
without being authenticated. But they need to be authenticated when accessing
external resources.
Normally, the guest VLAN function is coupled with the dynamic VLAN delivery function.
Refer to AAA Operation for detailed information about the dynamic VLAN delivery function.
Enabling 802.1x re-authentication
802.1x re-authentication is timer-triggered or packet-triggered. It re-authenticates users
who have passed authentication. With 802.1x re-authentication enabled, the switch can
monitor the connection status of users periodically. If the switch receives no
re-authentication response from a user in a period of time, it tears down the connection to
the user. To connect to the switch again, the user needs to initiate 802.1x authentication
with the client software again.
z
When re-authenticating a user, a switch goes through the complete authentication
process. It transmits the username and password of the user to the server. The server
may authenticate the username and password, or, however, use re-authentication for
only accounting and user connection status checking and therefore does not
authenticate the username and password any more.
z
An authentication server running CAMS authenticates the username and password
during re-authentication of a user in the EAP authentication mode but does not in PAP
or CHAP authentication mode.