H3C Technologies H3C WX3000E Series Wireless Switches - Manual (Page 399)

383
Item Description
Guest VLAN
Specify an existing VLAN as the guest VLAN. For more information, see " Configuring an
802.1X guest VLAN ."
Enable MAC VLAN
Select the box to enable MAC-based VLAN.
NOTE:
Only hybrid ports support the feature.
Auth-Fail VLAN
Specify an existing VLAN as the Auth-Fail VLAN to accommodate users that have failed
802.1X authentication.
For more information, see "
Configuring an Auth-Fail VLAN ."
Configuring an 802.1X guest VLAN
• Configuration guidelines:
You can configure only one 802.1X guest VLAN on a port. The 802.1X guest VLANs on
different ports can be different.
Assign different IDs for the default VLAN, and 802.1X guest VLAN on a port, so the port can
correctly process incoming VLAN tagged traffic.
With 802.1X authentication, a hybrid port is always assigned to a VLAN as an untagged
member. After the assignment, do not re-configure the port as a tagged member in the VLAN.
Use Table 127 when you configure multiple security features on a port.
Table 127 Relationships of the 802.1X guest VLAN and other security features
Feature Relationship description
MAC authentication guest VLAN on a port that
performs MAC-based access control
Only the 802.1X guest VLAN take effect. A user that fails
MAC authentication will not be assigned to the MAC
authentication guest VLAN.
802.1X Auth-Fail VLAN on a port that performs
MAC-based access control
The 802.1X Auth-Fail VLAN has a higher priority.
Port intrusion protection on a port that performs
MAC-based access control
The 802.1X guest VLAN function has higher priority than the
block MAC action but lower priority than the shut down port
action of the port intrusion protection feature.
• Configuration prerequisites:
Create the VLAN to be specified as the 802.1X guest VLAN.
If the 802.1X-enabled port performs port-based access control, enable 802.1X multicast trigger
at the command-line interface (CLI). (802.1X multicast trigger is enabled by default.)
If the 802.1X-enabled port performs MAC-based access control, configure the port as a hybrid
port, enable MAC-based VLAN on the port, and assign the port to the 802.1X guest VLAN as
an untagged member.
Configuring an Auth-Fail VLAN
• Configuration guidelines:
Assign different IDs for the default VLAN, and 802.1X Auth-Fail VLAN on a port, so the port can
correctly process VLAN tagged incoming traffic.
Use Table 128 when you configure multiple security features on a port.