My understanding is as follows. The guest vlan is used if their is no 802.1x supplicant on the client (or it is disabled) and therefore no response to an EAP Polling Beacon. The auth-fail vlan is when the authentication actually fails. The device failing authentication will have access to the vlan specified in auth-fail. Your question was without a auth-fail vlan configured, will the device have access? I think you are correct in saying it will not. However, I need to double check that myself. According to the docCD, the default is "There is no auth-fail vlan configured" which does leave a bit of room for ambiguity.
> Today's Topics: > > 1. Verifying 802.1x guest vlan. (Simon Baumann) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 26 Aug 2009 17:28:31 +0200 > From: Simon Baumann <[email protected]> > Subject: [OSL | CCIE_Security] Verifying 802.1x guest vlan. > To: [email protected] > Message-ID: <[email protected]> > Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes > > Hi, > I just did a lab using cat3, acs, acs and xp for setting up an 802.1x > environment. Everything works fine, I could assing different vlans > based on the user credentials, DHCP included running on the switch. > Here's the configuration of the port facing to the xp ws. > > cat3#sh run int fa 0/15 > Building configuration... > > Current configuration : 184 bytes > ! > interface FastEthernet0/15 > switchport mode access > dot1x pae authenticator > dot1x port-control auto > dot1x violation-mode protect > dot1x guest-vlan 66 > dot1x auth-fail vlan 66 > end > > cat3# > > I extended it using an auth-fail and guest-vlan. Just for my > understanding: I could use the guest vlan to e. g. sperating guests > from my lan and only allowing them internet access or something like > this. > The auth-fail vlan is used, when the authentication fails. If none is > set, the port has no access. Is this correct? > TIA! > > Cheers > Simon > > > > End of CCIE_Security Digest, Vol 38, Issue 39 > ********************************************* >
_______________________________________________ For more information regarding industry leading CCIE Lab training, please visit www.ipexpert.com
