Fail Open VLAN

Fail Open VLAN provides network connectivity when the switch cannot connect to a RADIUS server. If the switch cannot connect to the primary and secondary RADIUS servers, then after a specified number of attempts to restore connectivity, the switch declares the RADIUS servers unreachable. Fail Open VLAN provides the below functionality:

When the EAP RADIUS servers are not reachable, Fail Open VLAN provides restricted access to devices, which is separate from the Guest VLAN.
The EAP and NEAP clients are not affected when the RADIUS servers are not reachable.

Fail Open VLAN is a per-port option. Enable Fail Open VLAN by setting a valid Fail Open VLAN ID. Configure the selected VLAN ID on the switch. Only port based VLANs must be used as Fail Open VLANs.

When you configure Fail Open VLAN on a port and the RADIUS servers are not reachable, then the Fail Open VLAN provides the following functionality:

The port is removed from Guest VLAN if configured, but all other VLAN membership is kept and in addition the port is added to the Fail Open VLAN.
Default VLAN ID is changed to Fail Open VLAN ID.
Traffic from the authenticated EAP and NEAP clients are forwarded as before.
If re-authentication is enabled in Fail Open VLAN mode, then EAP and NEAP clients stop performing re-authentication.
All new MACs seen on the port are considered as potential EAP and NEAP clients and is granted Fail Open VLAN access.

When at least one RADIUS server recovers, all EAP enabled ports are removed from the Fail Open VLAN. All unauthenticated MACs are flushed in order to give the MACs an opportunity to authenticate.

Fail Open VLAN with Guest VLAN scenarios

When an EAP port is configured with both Fail Open VLAN and Guest VLAN, consider the following scenarios:

EAP port operating in MHMV mode:
- If the EAP RADIUS servers are reachable, then all the authenticated clients have Guest VLAN ID access.
- If the EAP RADIUS servers are not reachable, then Guest VLAN must be removed from the port completely. Fail Open VLAN is the new default VLAN. All unauthenticated MACs have Fail Open VLAN access.
EAP port operating in MHSA mode:
- Fail Open VLAN has no impact on the Guest VLAN functionality in MHSA mode.