Fail Open I-SID

Fail Open I-SID provides network connectivity with restricted access to devices when the switch cannot connect to a RADIUS server. If the switch cannot connect to the primary and secondary RADIUS servers after a specified number of attempts to restore connectivity, the switch declares the RADIUS servers unreachable.

Note

EAP and NEAP clients are not affected when the RADIUS servers are unreachable.

Fail Open I-SID is a per-port option. You must configure an I-SID either as a C-VLAN or as an ELAN with an associated platform VLAN before you can configure it as the Fail-Open I-SID. After you configure the Fail Open I-SID and you enable EAP, an untagged S-UNI is created based on the supplied I-SID. When you change the Fail Open I-SID while EAP is enabled, the untagged S-UNI is replaced on the port.

Note

Fail-Open I-SID is not supported in MHSA mode.

In MHMV mode, the untagged S-UNIs provided by the RADIUS server are treated as MAC-based untagged S-UNIs, which are different from the untagged S-UNIs on the port. Consider the following factors:

If there is a manually configured untagged S-UNI on the port, the untagged S-UNI, which uses the Fail Open I-SID, replaces it.
Caution is advised when both Fail-Open I-SID and Guest I-SID are configured. In this scenario, if a RADIUS server becomes reachable, the untagged S-UNI created based on the Fail-Open I-SID is removed and another untagged S-UNI based on the Guest I-SID is created.