Cisco Cisco Gigabit Ethernet Switch Module (CGESM) for HP Technical References
2-73
Cisco Gigabit Ethernet Switch Module for the HP p-Class BladeSystem Command Reference Guide
380265-002
Chapter 2 CGESM Switch Cisco IOS Commands
dot1x guest-vlan
dot1x guest-vlan
Use the dot1x guest-vlan interface configuration command to specify an active VLAN as an
IEEE 802.1x guest VLAN. Use the no form of this command to return to the default setting.
IEEE 802.1x guest VLAN. Use the no form of this command to return to the default setting.
dot1x guest-vlan vlan-id
no dot1x guest-vlan
Syntax Description
Defaults
No guest VLAN is configured.
Command Modes
Interface configuration
Command History
Usage Guidelines
You can configure a guest VLAN on one of these switch ports:
•
A static-access port that belongs to a non-private VLAN.
•
A private-VLAN port that belongs to a secondary private VLAN. All the hosts connected to the
switch port are assigned to private VLANs, regardless whether the posture validation was
successful. The switch determines the primary private VLAN by using the primary- and
secondary-private-VLAN associations on the switch.
switch port are assigned to private VLANs, regardless whether the posture validation was
successful. The switch determines the primary private VLAN by using the primary- and
secondary-private-VLAN associations on the switch.
For each IEEE 802.1x port on the switch, you can configure a guest VLAN to provide limited services
to clients (a device or workstation connected to the switch) not currently running IEEE 802.1x. These
users might be upgrading their systems for IEEE 802.1x authentication, and some hosts, such as
Windows 98 systems, might not be IEEE 802.1x-capable.
to clients (a device or workstation connected to the switch) not currently running IEEE 802.1x. These
users might be upgrading their systems for IEEE 802.1x authentication, and some hosts, such as
Windows 98 systems, might not be IEEE 802.1x-capable.
When you enable a guest VLAN on an IEEE 802.1x port, the switch assigns clients to a guest VLAN
when it does not receive a response to its Extensible Authentication Protocol over LAN (EAPOL)
request/identity frame or when EAPOL packets are not sent by the client.
when it does not receive a response to its Extensible Authentication Protocol over LAN (EAPOL)
request/identity frame or when EAPOL packets are not sent by the client.
Before Cisco IOS Release 12.2(25)SE1, the switch did not maintain the EAPOL packet history and
allowed clients that failed authentication access to the guest VLAN, regardless of whether EAPOL
packets had been detected on the interface. You can use the dot1x guest-vlan supplicant global
configuration command to enable this optional behavior.
allowed clients that failed authentication access to the guest VLAN, regardless of whether EAPOL
packets had been detected on the interface. You can use the dot1x guest-vlan supplicant global
configuration command to enable this optional behavior.
With Cisco IOS Release 12.2(25)SE1 and later, the switch maintains the EAPOL packet history. If
another EAPOL packet is detected on the interface during the lifetime of the link, the guest VLAN
feature is disabled. If the port is already in the guest VLAN state, the port is returned to the unauthorized
state, and authentication is restarted. The EAPOL history is reset upon loss of link.
another EAPOL packet is detected on the interface during the lifetime of the link, the guest VLAN
feature is disabled. If the port is already in the guest VLAN state, the port is returned to the unauthorized
state, and authentication is restarted. The EAPOL history is reset upon loss of link.
vlan-id
Specify an active VLAN as an IEEE 802.1x guest VLAN. The range is 1
to 4094.
to 4094.
Release
Modification
12.2(25)SE1
This command was introduced.
12.2(25)SED
The usage guidelines were modified.