220PrerequisitesBefore you configure the MAC authentication guest VLAN on a port, complete the following tasks:• Create the VLAN to be specified as the MAC authentication guest VLAN.• Configure the port as a hybrid port, and configure the VLAN as an untagged member on theport.For information about VLAN configuration, see Layer 2—LAN Switching Configuration Guide.ProcedureTo configure the MAC authentication guest VLAN on a port:Step Command Remarks1. Enter system view. system-view N/A2. Enter Ethernet interfaceview.interface interface-typeinterface-number N/A3. Specify the MACauthentication guestVLAN on the port.mac-authenticationguest-vlan guest-vlan-idBy default, no MAC authentication guestVLAN exists.You can configure only one MACauthentication guest VLAN on a port.4. (Optional.) Set theauthentication intervalfor users in the MACauthentication guestVLAN.mac-authenticationguest-vlan auth-periodperiod-valueThe default setting is 30 seconds.Configuring a MAC authentication critical VLANRestrictions and guidelinesWhen you configure the MAC authentication critical VLAN on a port, follow the guidelines in Table13.Table 13 Relationships of the MAC authentication critical VLAN with other security featuresFeature Relationship description ReferenceQuiet feature of MACauthenticationThe MAC authentication critical VLAN feature hashigher priority.When a user fails MAC authentication because noRADIUS authentication server is reachable, theuser can access the resources in the criticalVLAN. The user's MAC address is not marked asa silent MAC address.See "Configuring MACauthentication timers."Super VLAN You cannot specify a VLAN as both a super VLANand a MAC authentication critical VLAN.See Layer 2—LANSwitching ConfigurationGuide.
