4 Connect the supplicant to the port configured for 802.1X.5 Verify that the port has been authorized and placed in the desired VLAN (refer to the illustration in Dynamic VLAN Assignment withPort Authentication).Guest and Authentication-Fail VLANsTypically, the authenticator (the Dell system) denies the supplicant access to the network until the supplicant is authenticated. If thesupplicant is authenticated, the authenticator enables the port and places it in either the VLAN for which the port is configured or theVLAN that the authentication server indicates in the authentication data.NOTE: Ports cannot be dynamically assigned to the default VLAN.If the supplicant fails authentication, the authenticator typically does not enable the port. In some cases this behavior is not appropriate.External users of an enterprise network, for example, might not be able to be authenticated, but still need access to the network. Also,some dumb-terminals, such as network printers, do not have 802.1X capability and therefore cannot authenticate themselves. To be able toconnect such devices, they must be allowed access the network without compromising network security.The Guest VLAN 802.1X extension addresses this limitation with regard to non-802.1X capable devices and the Authentication-fail VLAN802.1X extension addresses this limitation with regard to external users.• If the supplicant fails authentication a specified number of times, the authenticator places the port in the Authentication-fail VLAN.• If a port is already forwarding on the Guest VLAN when 802.1X is enabled, the port is moved out of the Guest VLAN and theauthentication process begins.Configuring a Guest VLANIf the supplicant does not respond within a determined amount of time ([reauth-max + 1] * tx-period, the system assumes that the hostdoes not have 802.1X capability and the port is placed in the Guest VLAN.NOTE: For more information about configuring timeouts, refer to ConfiguringTimeouts.Configure a port to be placed in the Guest VLAN after failing to respond within the timeout period using the dot1x guest-vlancommand from INTERFACE mode. View your configuration using the show config command from INTERFACE mode or using the showdot1x interface command from EXEC Privilege mode.Example of Viewing Guest VLAN ConfigurationDell(conf-if-Te-1/1/1/1)#dot1x guest-vlan 200Dell(conf-if-Te 1/1/1/1))#show config!interface TenGigabitEthernet 1/1/1/1switchportdot1x guest-vlan 200no shutdownDell(conf-if-Te 1/1/1/1))#Configuring an Authentication-Fail VLANIf the supplicant fails authentication, the authenticator re-attempts to authenticate after a specified amount of time.NOTE: For more information about authenticator re-attempts, refer to Configuring a Quiet Period after a FailedAuthentication.You can configure the maximum number of times the authenticator re-attempts authentication after a failure (3 by default), after which theport is placed in the Authentication-fail VLAN.802.1X 97
