Guest VLAN id: NONEAuth-Fail VLAN: DisableAuth-Fail VLAN id: NONEAuth-Fail Max-Attempts: NONECritical VLAN: DisableCritical VLAN id: NONEMac-Auth-Bypass: DisableMac-Auth-Bypass Only: DisableStatic-MAB: DisableStatic-MAB Profile: NONETx Period: 30 secondsQuiet Period: 60 secondsReAuth Max: 2Supplicant Timeout: 30 secondsServer Timeout: 30 secondsRe-Auth Interval: 3600 secondsMax-EAP-Req: 2Host Mode: SINGLE_HOSTAuth PAE State: ConnectingBackend State: IdleMulti-Supplicant Authentication802.1X multi-supplicant authentication enables multiple devices on a single authenticator port to access thenetwork by authenticating each device. In addition, multi-supplicant authentication uses dynamic MAC-basedVLAN assignment to place devices on different VLANs. This feature is different from multi-host authenticationin which multiple devices connected to a single authenticator port can access the network after only the onedevice is authenticated, and all hosts are placed in the same VLAN as the authenticated device.Multi-supplicant authentication is needed, for example, in the case of a workstation at which a VoIP phoneand PC are connected to a single authenticator port. Multi-host authentication could authenticate the firstdevice to respond, and then both devices could access the network. However, if you wanted to place them indifferent VLANs — a VoIP VLAN and a data VLAN — you would need to authenticate the devices separately sothat the RADIUS server can send each device’s VLAN assignment during that devices authentication process.During the authentication process, the switch is able to learn the MAC address of the device though theEAPoL frames, and the VLAN assignment from the RADIUS server. With this information it creates anauthorized-MAC-to-VLAN mapping table per port. Then, the system can tag all incoming untagged frameswith the appropriate VLAN-ID based on the table entries.Configuring Multi-Supplicant AuthenticationTo enable multi-supplicant authentication on a port, enter the dot1x host-mode multi-auth commandin Interface mode. To return to the default single-host authentication mode, enter the no dot1x host-mode command. To verify the currently configured authentication mode, enter the show dot1x interfacecommand.Dell(conf-if-te-1/3)# dot1x host-mode multi-authDell(conf-if-te-1/3)# do show dot1x interface tengigabitethernet 0103802.1x information on Te 0/0:-----------------------------Dot1x Status: Enable802.1X 121
