topic You can also check 'show int in Network Access Control

802.1x VLAN assignment

humair.amil — Mon, 11 Mar 2019 06:06:44 GMT

Hi all,

We have 802.1x authentication setup on our switches.

The switch ports have the following configured on them.

switchport access vlan 5

switchport mode access

switchport nonegotiate

switchport protected

logging event link-status

authentication port-control auto

dot1x pae authenticator

dot1x timeout tx-period 5

dot1x max-req 3

no cdp enable

spanning-tree portfast

spanning-tree bpduguard enable

ip verify source

Also, the network policy server is configured to assign VLAN 9 to the devices the authenticate successfully.

I can't seem to find out that which one will take precedence? For example, if I connect a device to a switch port that has "switchport access vlan 5" configured but the network policy servers return VLAN 9 to the switch on successful authentication of the device then which VLAN will the switch put the device in?

Hi, It will be placed in vlan

Jason van den Berg — Thu, 01 Oct 2015 09:40:18 GMT

Hi,

It will be placed in vlan 9. You can confirm this by issuing the following command on the switch "sh authentication sessions interface <interface id>" where interface id is the interface the device is connected to. An alternative is to enable logging on the switch en check the logs for interface events which will confirm the vlan the device is placed in.

Regards,

Jason

"show interface status" will

mbilgrav — Thu, 01 Oct 2015 09:40:19 GMT

"show interface status" will also show you the VLAN a given accessport is placed in.

You can also check 'show int

Shahzad Qadir — Thu, 01 Oct 2015 09:44:32 GMT

You can also check 'show int switchport' . That should show operational mode and Vlan assigned.

Thanks everyone.

humair.amil — Thu, 01 Oct 2015 10:07:03 GMT

Thanks everyone.