5.3.6 Operation when dot1q is set to MAC

If you use the switchport mac dot1q vlan configuration command to configure dot1q at a MAC port, tagged frames entering that port are authenticated according to fixed VLAN mode.

Untagged frames are authenticated according to dynamic VLAN mode. Note that untagged frames are associated with the native VLAN prior to authentication and with the designated VLAN ID after successful authentication.

The following figure describes the operation of the MAC port with dot1q configured:

Figure 5-6 Operation when dot1q is set in MAC port

If the configuration command mac-authentication dot1q-vlan force-authorized is set for the applicable port, Tagged frame MAC addressis judged to be authenticated exclusion, and communication can be performed without MAC authentication.

However, note the following because the Switch treats MAC addressas an authentication terminal for MAC authentication (authentication-excluded terminal):

• Authentication exception terminals are included in the number of authentication limits set for the applicable port.

• After you cancel terminal's authentication-exempted status, a logout message appears in the operation log. Because authentication-exempted status is canceled when a terminal is moved to another port, the same message will appear in the operation log after you move an authentication-exempted terminal between ports.

• The following triggers cancel the authentication-exempted status of a terminal:

  • An operation command is used to cancel authentication-exempted status.

    The authentication-exempted status of a terminal will be canceled if you specify its MAC address in the clear mac-authentication auth-state operation command.

    It also cancels its exempted status if you specify the option of the clear mac-authentication auth-state operation command that cancels the authentication status for all MAC-authenticated terminals.

  • The port to which an authentication-exempted terminal is connected is in link-down status.

    When the switch detects that a port is in link-down status, the terminals attached to the port will lose their authentication-exempted status.

  • An authentication-exempted terminal is aged out from the MAC address table.

    If there is no communication from an authentication-exempted terminal for a period of approximately 10 minutes after the aging time of the MAC address table has elapsed, the authentication-exempted status is canceled.

  • The VLAN configuration changes.

    The authentication-exempted status of a terminal will be canceled if you use a configuration command to change the configuration of the VLAN to which the terminal belongs.

    The following configuration changes trigger a logout:

    Deletion of the VLAN

    Suspension of the VLAN

  • The authentication mode changes.

    The authentication-exempted status of a terminal will be canceled if the copy command is used to change authentication modes.

  • MAC-based authentication is deleted.

    The authentication-exempted status of a terminal will be canceled if the no mac-authentication system-auth-control configuration command is used to delete MAC-based authentication.

The following table describes the operation of Layer 2 authentication with dot1q configured at a MAC port:

Table 5-20 Layer 2 authentication operation when dot1q is configured on the MAC port

Frame type	Web Authentication	MAC-based Authentication
Untagged frame	Subject to authentication in dynamic VLAN mode	Subject to authentication in dynamic VLAN mode
Tagged frame	Cannot be authenticated	Subject to authentication in fixed VLAN mode