Powerconnect 5548 Guest-Vlan and authentication issue

Question

Hi everyone. I've got a little problem with my authentication configuration on a powerconnect 5548. I use the MAC adresses of my users to authenticate them and it works perfectly. I decided to add dynamic vlan assignment, so when the users are identfied, they will be in the appropriate vlan. But the problem is when a user is identified, he is in two vlans : the vlan where the user is supposed to be and the guest vlan that I configured 'cause the authentication doesn't work without it. But the user must be in only one vlan, not in the guest at the same time.  I read the CLI guide of the switch and it appears that user is in the guest vlan automatically after a successfull authentication. Here is my switch's configuration : SW5548# sh rundot1x guest-vlan timeout 30vlan databasevlan 10,20,30,40,50,60,70,80,90,100exitvoice vlan oui-table add 000181 Nortel__________________voice vlan oui-table add 0001e3 Siemens_AG_phone________voice vlan oui-table add 00036b Cisco_phone_____________voice vlan oui-table add 00096e Avaya___________________voice vlan oui-table add 000fe2 H3C_Aolynk______________voice vlan oui-table add 001049 Shoretel________________voice vlan oui-table add 0060b9 Philips_and_NEC_AG_phonevoice vlan oui-table add 00907a Polycom/Veritel_phone___voice vlan oui-table add 00e0bb 3Com_phone______________dot1x system-auth-controlgvrp enableiscsi target port 860 address 0.0.0.0iscsi target port 3260 address 0.0.0.0iscsi target port 9876 address 0.0.0.0iscsi target port 20002 address 0.0.0.0iscsi target port 20003 address 0.0.0.0iscsi target port 25555 address 0.0.0.0hostname SW5548radius-server host 192.168.12.15 key testaaa authentication enable default enableaaa authentication login default radiusaaa authentication dot1x default radiusline telnetpassword 6e949a9a71d9dfb6f903ac979dd79e07b39e4c3f encryptedexitenable password level 15 encrypted 6e949a9a71d9dfb6f903ac979dd79e07b39e4c3fusername adminsw password encrypted 6e949a9a71d9dfb6f903ac979dd79e07b39e4c3f privilege 15ip ssh server!interface vlan 40 ip address 192.168.12.20 255.255.255.0 dot1x guest-vlan!interface gigabitethernet1/0/1 dot1x max-req 5 dot1x timeout reauth-period 300 dot1x timeout server-timeout 5 switchport mode trunkinterface gigabitethernet1/0/3 dot1x host-mode multi-sessions dot1x guest-vlan enable dot1x reauthentication dot1x mac-authentication mac-only dot1x radius-attributes vlan dot1x port-control auto!interface gigabitethernet1/0/4 switchport access vlan 100!interface gigabitethernet1/0/5 switchport access vlan 100!interface gigabitethernet1/0/6 switchport access vlan 100!interface gigabitethernet1/0/7 switchport access vlan 100 The other interfaces have the same configuration. Here is my radius users file configuration : '0019b91e0b42  Cleartext-Password := '0019b91e0b42'        Service-Type = Framed-User,        Tunnel-type = VLAN,        Tunnel-Medium-Type = IEEE-802,        Tunnel-private-Group-ID = 20' My questions are : -Is that a problem that users are in the guest vlan? -Can I put my users in only one vlan or at least not in the guest-vlan ? -Where is the problem ? Thank you very much for your help.

franckd · Answer

Hi, thanks for replying . I know that is a normal behaviour, but I want to avoid it if it's possible. I already read the user guide and I didn't find any information that could help me. Thank you.

Networking General

Was this post helpful?