6.2.8 VLAN Per-Authentication (Dynamic) Operating Modes

Terminals authenticated by VLAN-based authentication (dynamic) do not count against the maximum number of authenticated users. However, when a port that performs VLAN-based authentication (dynamic) authentication has any of the characteristics listed below, terminals attached to that port count against the maximum number of authenticated users, and can no longer use the authentication default VLAN. For details about the authentication limit, see 5.3.3 "Authentication limit".

• Web authentication (dynamic VLAN mode) is configured

• MAC-based authentication is configured

• Dot1q is configured in a VLAN with a VLAN-based authentication (static) policy

• An authentication IPv4 access list is specified

• The port is configured to relay ARP packets from unauthenticated terminals

• auto is specified as the terminal detection behavior switching option (affects all ports)