Enable MAC-based VLAN on the port. For more information about the MAC-based VLAN
feature, see Layer 2—LAN Switching Configuration Guide.
Assign the port to the 802.1X guest VLAN as an untagged member.
Configuration procedure
To configure an 802.1X guest VLAN:
Step
1.
Enter system view.
2.
Enter Ethernet interface view.
3.
Configure the 802.1X guest
VLAN on the port.
Configuring an 802.1X Auth-Fail VLAN
Configuration guidelines
When you configure an 802.1X Auth-Fail VLAN, follow these restrictions and guidelines:
Assign different IDs to the voice VLAN, the port VLAN, and the 802.1X Auth-Fail VLAN on a port.
•
The assignment ensures that the port can correctly process VLAN-tagged incoming traffic.
You can configure only one 802.1X Auth-Fail VLAN on a port. The 802.1X Auth-Fail VLANs on
•
different ports can be different.
•
When you configure multiple security features on a port, follow the guidelines in
Table 8 Relationships of the 802.1X Auth-Fail VLAN with other features
Feature
MAC authentication guest VLAN
on a port that performs
MAC-based access control
Port intrusion protection actions
on a port that performs
MAC-based access control
Configuration prerequisites
Before you configure an 802.1X Auth-Fail VLAN, complete the following tasks:
Create the VLAN to be specified as the 802.1X Auth-Fail VLAN.
•
Command
system-view
interface interface-type
interface-number
dot1x guest-vlan guest-vlan-id
Relationship description
The 802.1X Auth-Fail VLAN has
a high priority.
The 802.1X Auth-Fail VLAN
feature has higher priority than
the block MAC action.
The 802.1X Auth-Fail VLAN
feature has lower priority than
the shutdown port action of the
port intrusion protection feature.
87
Remarks
N/A
N/A
By default, no 802.1X guest VLAN
is configured on any port.
Table
Reference
See
"Configuring MAC
authentication."
See
"Configuring port
security."
8.