Filter
Top Products
8-25
Configuring Port-Based Access Control (802.1X)
802.1X Open VLAN Mode
Operating Rules for Authorized-Client and
Unauthorized-Client VLANs
Condition Rule
Static VLANs used as Authorized-
Client or Unauthorized-Client VLANs
These must be configured on the switch before you configure an
802.1X authenticator port to use them. (Use the vlan < vlan-id >
command or the VLAN Menu screen in the Menu interface.)
VLAN Assignment Received from a
RADIUS Server
If the RADIUS server specifies a VLAN for an authenticated supplicant
connected to an 802.1X authenticator port, this VLAN assignment
overrides any Authorized-Client VLAN assignment configured on the
authenticator port. This is because both VLANs are untagged, and the
switch allows only one untagged VLAN membership per-port. For
example, suppose you configured port A4 to place authenticated
supplicants in VLAN 20. If a RADIUS server authenticates supplicant
“A” and assigns this supplicant to VLAN 50, then the port can access
VLAN 50 as an untagged member while the client session is running.
When the client disconnects from the port, then the port drops these
assignments and uses the untagged VLAN memberships for which it
is statically configured. (After client authentication, the port resumes
any tagged VLAN memberships for which it is already configured. For
details, refer to the Note on page 8-22.)
Temporary VLAN Membership During
a Client Session
• Port membership in a VLAN assigned to operate as the
Unauthorized-Client VLAN is temporary, and ends when the client
receives authentication or the client disconnects from the port,
whichever is first.
• Port membership in a VLAN assigned to operate as the Authorized-
Client VLAN is also temporary, and ends when the client
disconnects from the port.If a VLAN assignment from a RADIUS
server is used instead, the same rule applies.
Effect of Unauthorized-Client VLAN
session on untagged port VLAN
membership
• When an unauthenticated client connects to a port that is already
configured with a static, untagged VLAN, the switch temporarily
moves the port to the Unauthorized-Client VLAN (also untagged).
(While the Unauthorized-Client VLAN is in use, the port does not
access the static, untagged VLAN.)
• When the client either becomes authenticated or disconnects, the
port leaves the Unauthorized-Client VLAN and reacquires its
untagged membership in the statically configured VLAN.