(Optional) Configuring the Guest VLAN Function

Context

You can configure a guest VLAN on a device interface so that users can access some network resources without being authenticated. The user is added to the guest VLAN before being authenticated to access resources in the guest VLAN. However, the users still must be authenticated before accessing network resources outside the guest VLAN.

Procedure

Run system-view
The system view is displayed.
Configure the guest VLAN function in the system or interface view.
- In the system view:
1. Run authentication guest-vlan vlan-id interface { interface-type interface-number1 [ to interface-number2 ] } &<1-10>
  The guest VLAN to which the interface is added is configured.
- In the interface view:
1. Run interface interface-type interface-number
  The interface view is displayed.
2. Run authentication guest-vlan vlan-id
  The guest VLAN to which the interface is added is configured.
By default, an interface is not added to the guest VLAN.
- The guest VLAN function can take effect only in 802.1X and MAC address authentication.
- A super VLAN cannot be configured as a guest VLAN.
- When free IP subnets are configured, the guest VLAN function becomes invalid immediately.
- If the authentication function of the built-in Portal server is enabled, the guest VLAN cannot be configured on interfaces.
- The guest VLAN function takes effect only when a user sends untagged packets to the device.
- Different interfaces can be configured with different guest VLANs. After a guest VLAN is configured on an interface, the guest VLAN cannot be deleted.
- To make the VLAN authorization function take effect, the link type and access control mode of the authentication interface must meet the following requirements:
  - When the link type is hybrid in untagged mode, the access control mode can be based on the MAC address or interface.
  - When the link type is access or trunk, the access control mode can only be based on the interface.