77
Authentication status
VLAN manipulation
A user in the 802.1X critical VLAN fails
authentication for any other reasons
except for unreachable servers.
If an 802.1X Auth-Fail VLAN has been configured, the PVID of
the port changes to the Auth-Fail VLAN ID, and all 802.1X users
on this port are moved to the Auth-Fail VLAN. If no 802.1X
Auth-Fail VLAN is configured, the initial PVID of the port is
restored.
A user in the 802.1X critical VLAN passes
802.1X authentication.
•
The device assigns the authorization VLAN of the user to
the port as the PVID, and it removes the port from the
802.1X critical VLAN. After the user logs off, the guest
VLAN ID changes to the PVID. If no 802.1X guest VLAN is
configured, the initial PVID of the port is restored.
•
If the authentication server (either the local access device
or a RADIUS server) does not authorize a VLAN, the initial
PVID of the port applies. The user and all subsequent
802.1X users are assigned to this port VLAN. After the
user logs off, the PVID remains unchanged.
A user in the 802.1X guest VLAN fails
authentication because all the RADIUS
servers are unreachable.
The device assigns the 802.1X critical VLAN to the port as the
PVID, and all 802.1X users on this port are in this VLAN.
A user in the 802.1X Auth-Fail VLAN fails
authentication because all the RADIUS
servers are unreachable.
The PVID of the port remains unchanged. All 802.1X users on
this port can access resources only in the 802.1X Auth-Fail
VLAN.
A user who has passed authentication
fails reauthentication because all the
RADIUS servers are unreachable, and
the user is logged out of the device.
The device assigns the 802.1X critical VLAN to the port as the
PVID.
Mandatory authentication domain
You can place all 802.1X users in a mandatory authentication domain for authentication,
authorization, and accounting on a port. No user can use an account in any other domain to access
the network through the port. The implementation of a mandatory authentication domain enhances
the flexibility of 802.1X access control deployment.
EAD assistant
Endpoint Admission Defense (EAD) is an integrated endpoint access control solution to improve the
threat defensive capability of a network. The solution enables the security client, security policy
server, access device, and third-party server to operate together. If a terminal device seeks to access
an EAD network, it must have an EAD client, which performs 802.1X authentication.
The EAD assistant feature enables the access device to redirect a user who is seeking to access the
network to download and install an EAD client. This feature eliminates the administrative task to
deploy EAD clients.
MAC authentication
Overview
MAC authentication controls network access by authenticating source MAC addresses on a port.
The feature does not require client software, and users do not have to enter usernames and
passwords for network access. The device initiates a MAC authentication process when it detects an
unknown source MAC address on a MAC authentication-enabled port.
