Allied Telesis AT-FS970M Series - Manual (Page 206)

Chapter 18: 802.1x Port-based Network Access
206
Guest VLAN An authenticator port in the unauthorized state typically accepts and
transmits only 802.1x packets while waiting to authenticate a supplicant.
However, you can specify an authenticator port to be a member of a Guest
VLAN when no authenticated supplicant is logged on. Any guest user
using the port is not required to log on and has full access to the resources
of the Guest VLAN.
If the switch receives 802.1x packets on the port, signalling that an
authenticated supplicant is logging on, it moves the port to its predefined
VLAN and places it in the unauthorized state. The port remains in the
unauthorized state until the logon process between the authenticated
supplicant and the RADIUS server is completed. When the authenticated
supplicant logs off, the port automatically returns to the Guest VLAN.
Note
The Guest VLAN feature is only supported on an authenticator port
in the Single host operating mode.