Documentation states:
I'm running 12.2(33)SXI. The documentation states:
With Cisco IOS Release 12.2(33)SXH and later releases, when you configure a guest VLAN, clients that are not 802.1X-capable are put into the guest VLAN when the server does not receive a response to its EAP request/identity frame. Clients that are 802.1X-capable but that fail authentication are not granted network access. When operating as a guest VLAN, a port functions in multiple-hosts mode regardless of the configured host mode of the port.
http://www.cisco.com/en/US/customer/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/dot1x.html#wp1135086
I've configured the following (in addition to the normal 802.1x commands) on the port to which the client is connected:
authentication event no-response action authorize vlan 100
&
authentication event fail action authorize vlan 100
Where vlan 100 is the guest VLAN--i.e. I want any client that has either 1) no 802.1x supplicant configured on the workstation or 2) does not have a valid login/password, to be placed on this VLAN. The problem I run into is that neither of these two things are happening. I can authenticate users with valid login credentials against AD and internal database but when a user without valid credentials attempts to log on or one without a supplicant attempts to connect, I see the debugs in the switch just sending EAP polls to the client. I would expect that it should put the client on the guest VLAN after the attempts time out or if the user provides invalid credentials. This doesn't happen. Please advise. Thanks.
