Guest VLAN

107

16    802.1X Network Access Control

Guest VLAN

The Guest VLAN feature allows a switch to provide a distinguished service to unauthenticated 
users. This feature provides a mechanism to allow visitors and contractors to have network 
access to reach external network with no ability to surf internal LAN.

When a client that does not support 802.1X is connected to an unauthorized port that is 
802.1X-enabled, the client does not respond to the 802.1X requests from the switch. 
Therefore, the port remains in the unauthorized state, and the client is not granted access to the 
network. If a guest VLAN is configured for that port, then the port is placed in the configured 
guest VLAN and the port is moved to the authorized state, allowing access to the client.

Client devices that are 802.1X-supplicant-enabled authenticate with the switch when they are 
plugged into the 802.1X-enabled switch port. The switch verifies the credentials of the client 
by communicating with an authentication server. If the credentials are verified, the 
authentication server informs the switch to 'unblock' the switch port and allows the client 
unrestricted access to the network; i.e., the client is a member of an internal VLAN.

Guest VLAN Supplicant mode is a global configuration for all the ports on the switch. When a 
port is configured for Guest VLAN in this mode, if a client fails authentication on the port, the 
client is assigned to the guest VLAN configured on that port. The port is assigned a Guest 
VLAN ID and is moved to the authorized status. Disabling the supplicant mode does not clear 
the ports that are already authorized and assigned Guest VLAN IDs.

Configuring the Guest VLAN by Using the CLI

To enable the Guest VLAN Supplicant Mode, use the 

dot1x guest-vlan supplicant

command in Global Config mode.

To configure a VLAN as guest VLAN on a per port basis, enter the Interface Config mode for 
the port and use the 

dot1x guest-vlan 

<vlan-id> 

command.