Filter
Top Products
Device Security 109
802.1X Authentication and VLANs
The PowerConnect 6200 Series switches allow a port to be placed into a particular VLAN based on the
result of type of 802.1X authentication a client uses when it accesses the switch. The RADIUS server or
IEEE 802.1X Authenticator can provide information to the switch about which VLAN to assign the host
(supplicant).
When a host connects to a switch that uses a RADIUS server or 802.1X Authenticator to authenticate
the host, the host authentication can typically have one of three outcomes:
• The host is authenticated.
• The host attempts to authenticate but fail because it lacks certain security credentials.
• The host is a guest and does not try to authenticate at all.
You can create three separate VLANs on the switch to handle hosts depending on whether the host
authenticates, fails the authentication, or is a guest. The RADIUS server informs the switch of the
selected VLAN as part of the authentication.
Authenticated and Unauthenticated VLANs
Hosts that authenticate normally use a VLAN that includes access to network resources. Hosts that fail
the authentication might be denied access to the network or placed on a "quarantine" VLAN with
limited network access.
Much of the configuration to assign hosts to a particular VLAN takes place on the RADIUS server or
802.1X authenticator. If you use an external RADIUS server to manage VLANs, you configure the server
to use Tunnel attributes in Access-Accept messages in order to inform the switch about the selected
VLAN. These attributes are defined in RFC 2868, and their use for dynamic VLAN is specified in RFC
3580.
The VLAN attributes defined in RFC3580 are as follows:
• Tunnel-Type=VLAN (13)
• Tunnel-Medium-Type=802
• Tunnel-Private-Group-ID=VLANID
VLANID is 12-bits and has a value between 1 and 4093.
Guest VLAN
The Guest VLAN feature allows a switch to provide a distinguished service to unauthenticated users.
This feature provides a mechanism to allow visitors and contractors to have network access to reach
external network with no ability to browse information on the internal LAN.
In port-based 802.1X mode, when a client that does not support 802.1X is connected to an unauthorized
port that is 802.1X-enabled, the client does not respond to the 802.1X requests from the switch.
Therefore, the port remains in the unauthorized state, and the client is not granted access to the
network. If a guest VLAN is configured for that port, then the port is placed in the configured guest