dot1x guest-vlan
Syntax
In system view:
dot1x guest-vlan guest-vlan-id [ interface interface-list ]
undo dot1x guest-vlan [ interface interface-list ]
In Ethernet interface view:
dot1x guest-vlan guest-vlan-id
undo dot1x guest-vlan
View
System view, Ethernet interface view
Default level
2: System level
Parameters
guest-vlan-id: Specifies the ID of the VLAN to be specified as the 802.1X guest VLAN, in the range of 1 to 4094. Make sure that the VLAN has been created.
interface interface-list: Specifies a port list. The interface-list argument is in the format of interface-list = { interface-type interface-number [ to interface-type interface-number ] } & <1-10>, where interface-type represents the port type, interface-number represents the port number, and & <1-10> means that you can provide up to 10 ports or port ranges. The start port number must be smaller than the end number and the two ports must be of the same type. If no interface is specified, you configure an 802.1X guest VLAN for all Layer 2 Ethernet ports.
Description
Use dot1x guest-vlan to configure an 802.1X guest VLAN for the specified or all ports.
Use undo dot1x guest-vlan to remove the 802.1X guest VLAN on the specified or all ports.
By default, no 802.1X guest VLAN is configured on a port.
You must enable 802.1X for an 802.1X guest VLAN to take effect.
To have the 802.1X guest VLAN take effect, complete the following tasks:
Enable 802.1X both globally and on the interface.
If the port performs port-based access control, enable the 802.1X multicast trigger function.
If the port performs MAC-based access control, configure the MAC-based VLAN function on the port.
When you change the access control method from MAC-based to port-based on a port that carries a guest VLAN, the mappings between MAC addresses and the 802.1X guest VLAN are removed. You can use the display mac-vlan command to display MAC-to-VLAN mappings.
When you change the access control method from port-based to MAC-based on a port that is in a guest VLAN, the port is removed from the guest VLAN.
To delete a VLAN that has been configured as a guest VLAN, you must remove the guest VLAN configuration first.
Related commands: dot1x, dot1x port-method, and dot1x multicast-trigger; mac-vlan enable and display mac-vlan (Layer 2—LAN Switching Command Reference).
Examples
# Specify VLAN 999 as the 802.1X guest VLAN for port Ethernet 1/0/1.
<Sysname> system-view [Sysname] dot1x guest-vlan 999 interface ethernet 1/0/1
# Specify VLAN 10 as the 802.1X guest VLAN for ports Ethernet 1/0/2 to Ethernet 1/0/5.
<Sysname> system-view [Sysname] dot1x guest-vlan 10 interface ethernet 1/0/2 to ethernet 1/0/5
# Specify VLAN 7 as the 802.1X guest VLAN for all ports.
<Sysname> system-view [Sysname] dot1x guest-vlan 7
# Specify VLAN 3 as the 802.1X guest VLAN for port Ethernet 1/0/7.
<Sysname> system-view [Sysname] interface ethernet 1/0/7 [Sysname-Ethernet1/0/7] dot1x guest-vlan 3