dot1x auth-fail vlan

Syntax

dot1x auth-fail vlan authfail-vlan-id

undo dot1x auth-fail vlan

View

Ethernet interface view

Default level

2: System level

Parameters

authfail-vlan-id: Specifies the ID of the Auth-Fail VLAN for the port, in the range of 1 to 4094. Make sure that the VLAN has been created.

Description

Use dot1x auth-fail vlan to configure an Auth-Fail VLAN for a port. An Auth-Fail VLAN accommodates users that have failed 802.1X authentication because of the failure to comply with the organization security strategy, such as using a wrong password.

Use undo dot1x auth-fail vlan to restore the default.

By default, no Auth-Fail VLAN is configured on a port.

You must enable MAC-based VLAN for an Auth-Fail VLAN to take effect on a port that performs MAC-based access control.

When you change the access control method from MAC-based to port-based on a port that carries an Auth-Fail VLAN, the mappings between MAC addresses and the 802.1X Auth-Fail VLAN are removed. You can use the display mac-vlan command to display MAC-to-VLAN mappings.

You must enable 802.1X multicast trigger function for an Auth-Fail VLAN to take effect on a port that performs port-based access control.

When you change the access control method from port-based to MAC-based on a port that is in an Auth-Fail VLAN, the port is removed from the Auth-Fail VLAN.

To delete a VLAN that has been configured as an Auth-Fail VLAN, you must remove the Auth-Fail VLAN configuration first.

Related commands: dot1x and dot1x port-method.

Examples

# Configure VLAN 3 as the Auth-Fail VLAN for port Ethernet 1/0/1.

<Sysname> system-view
[Sysname] interface ethernet 1/0/1
[Sysname-Ethernet1/0/1] dot1x auth-fail vlan 3