H3C Technologies H3C WX3000E Series Wireless Switches - Manual (Page 137)

123
Step Command Remarks
2. Configure an 802.1X guest VLAN
for one or more ports.
• In system view:
dot1x guest-vlan guest-vlan-id
[ interface interface-list ]
• In Ethernet interface view:
a. interface interface-type
interface-number
b. dot1x guest-vlan
guest-vlan-id
Use either approach.
By default, no 802.1X guest
VLAN is configured on any
port.
Configuring an Auth-Fail VLAN
Configuration guidelines
Follow these guidelines when you configure an Auth-Fail VLAN:
• Auth-Fail VLAN is supported only on ports that performs MAC-based access control.
• You can configure only one 802.1X Auth-Fail VLAN on a port. The 802.1X Auth-Fail VLANs on
different ports can be different.
• Assign different IDs for the default VLAN, and the 802.1X Auth-Fail VLAN on a port, so the port can
correctly process VLAN tagged incoming traffic.
• Use Table 7 when configuring multiple security features on a port.
Table 7 Relationships of the 802.1X Auth-Fail VLAN with other features
Feature Relationship description Reference
MAC authentication guest VLAN
on a port that performs
MAC-based access control
The 802.1X Auth-Fail VLAN has a high
priority. See "Configuring MAC
authentication."
Port intrusion protection on a port
that performs MAC-based access
control
The 802.1X Auth-Fail VLAN function has
higher priority than the block MAC action
but lower priority than the shut down port
action of the port intrusion protection
feature.
See "Configuring port
security."
Configuration prerequisites
• Create the VLAN to be specified as the 802.1X Auth-Fail VLAN.
• On the 802.1X-enabled port that performs MAC-based access control, configure the port as a
hybrid port, enable MAC-based VLAN on the port, and assign the port to the Auth-Fail VLAN as an
untagged member. For more information about the MAC-based VLAN function, see Layer 2
Configuration Guide.
Configuration procedure
To configure an Auth-Fail VLAN: