Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR) v1.2SecurityMedium
A network administrator is configuring network access control using 802.1X on a Cisco switch. The administrator wants to ensure that if the RADIUS server is unavailable, clients can still gain limited network access to a specific VLAN for remediation purposes (e.g., patching, anti-virus updates). Which 802.1X feature should be configured to achieve this fallback behavior?
- AGuest VLAN
- BHost mode multi-domain
- CCritical authentication
- DAuthentication open
Show answer & explanationAnswer & explanation
Correct answer: A. Guest VLAN
A Guest VLAN is an 802.1X feature that provides limited network access to clients that fail 802.1X authentication or for whom the RADIUS server is unreachable. This allows them to access resources like patching servers or web portals for remediation before full network access is granted.
Why the other options are wrong
- B. Host mode multi-domain allows multiple hosts (voice and data) on a single port but doesn't address RADIUS server unavailability fallback.
- C. Critical authentication (also known as 'dot1x critical') is used for specific critical devices to bypass authentication, not for general clients needing remediation access when the server is down.
- D. Authentication open allows all clients to access the network without authentication, which is not secure and doesn't provide a limited remediation VLAN.
802.1X Guest VLAN
An 802.1X feature that provides a temporary, restricted network access VLAN for clients that fail authentication or when the authentication server is unavailable. This allows clients to perform necessary remediation tasks before attempting full authentication.
- Assigns clients to a specific VLAN with limited access.
- Used for unauthenticated clients or when the RADIUS server is down.
- Facilitates patching, anti-virus updates, or registration for new devices.
Memory trick: If the door's locked, go to the Guest room for a fix!