Configuring A Guest Vlan; Configuring An Authentication-Fail Vlan - Dell Force10 Z9000 Configuration Manual

• If the supplicant fails authentication a specified number of times, the authenticator places the port in the Authentication-fail
VLAN.
• If a port is already forwarding on the Guest VLAN when 802.1X is enabled, the port is moved out of the Guest VLAN and the
authentication process begins.

Configuring a Guest VLAN

If the supplicant does not respond within a determined amount of time ([reauth-max + 1] * tx-period, the system assumes that the
host does not have 802.1X capability and the port is placed in the Guest VLAN.
NOTE: For more information about configuring timeouts, refer to
Configure a port to be placed in the Guest VLAN after failing to respond within the timeout period using the dot1x guest-vlan
command from INTERFACE mode. View your configuration using the show config command from INTERFACE mode or using
the show dot1x interface command from EXEC Privilege mode.
Example of Viewing Guest VLAN Configuration
Dell(conf-if-Te-2/1)#dot1x guest-vlan 200
Dell(conf-if-Te 2/1))#show config
!
interface TenGigabitEthernet 2/1
switchport
dot1x guest-vlan 200
no shutdown
Dell(conf-if-Te 2/1))#

Configuring an Authentication-Fail VLAN

If the supplicant fails authentication, the authenticator re-attempts to authenticate after a specified amount of time.
NOTE: For more information about authenticator re-attempts, refer to
Authentication.
You can configure the maximum number of times the authenticator re-attempts authentication after a failure (3 by default), after
which the port is placed in the Authentication-fail VLAN.
Configure a port to be placed in the VLAN after failing the authentication process as specified number of times using the dot1x
auth-fail-vlan command from INTERFACE mode. Configure the maximum number of authentication attempts by the
authenticator using the keyword max-attempts with this command.
Example of Configuring Maximum Authentication Attempts
Dell(conf-if-Te-2/1)#dot1x guest-vlan 200
Dell(conf-if-Te 2/1)#show config
!
interface TenGigabitEthernet 2/1
switchport
dot1x authentication
dot1x guest-vlan 200
no shutdown
Dell(conf-if-Te-2/1)#
Dell(conf-if-Te-2/1)#dot1x auth-fail-vlan 100 max-attempts 5
Dell(conf-if-Te-2/1)#show config
!
interface TenGigabitEthernet 2/1
switchport
dot1x authentication
dot1x guest-vlan 200
dot1x auth-fail-vlan 100 max-attempts 5
no shutdown
Dell(conf-if-Te-2/1)#
Configuring Timeouts.
Configuring a Quiet Period after a Failed
83
802.1X