Juniper Networks EX Series switches use VLANs to make logical groupings of network nodes with their own broadcast domains. VLANs limit the traffic flowing across the entire LAN and reduce collisions and packet retransmissions.

There are several ways in which a VLAN can be configured:

• Port-based VLAN assignment.
• MAC-based VLAN assignment.

The 802.1X protocol is used to perform port-level authentication and control of devices connected to the 802.1X-enabled LAN ports. With the 802.1X protocol employed, a user-side device can access the LAN only after it passes the authentication. Devices that fail to pass the authentication are denied access to the LAN.

The most common way of grouping VLAN members is by port through manual assignment of individual ports to specific VLANs. User intervention is required in manually adding the ports to the specific VLANs. The port thus marked for a VLAN will always be part of the VLAN.

Another method of VLAN assignment is MAC-based. Here the grouping is not based on the ports but is based on the MAC address. MAC-based VLANs are mostly used in conjunction with security technologies such as 802.1X to provide secure and flexible access to end devices.

This MAC-based VLAN assignment can be done using two different methods:

• Static assignment, where MAC binding is done statically by assigning a specific MAC address to a VLAN. 

• Dynamic assignment, where the MAC gets authenticated by an authentication device prior to allowing users access availability. This comes in handy for large-scale network deployments. See Configuring 802.1X Interface Settings. 

Scenario:

Let's say we have an EX switch connecting to an authentication device (RADIUS). This EX switch is also connected to a hub on which we have multiple PCs connected belonging to different VLANs.

PC-A belongs to VLAN vlan102, PC-B belongs to VLAN 99, and PC-C belongs to VLAN quarantine.

As the diagram shows, there is a single port from the EX switch connecting to the hub on which these PCs are connected. So as per the switch, it is a single interface connecting to multiple devices.

We are enabling dot1x configuration for security purposes. When the PCs are connected, the MAC for these PCs will not be learned initially -- they go through an authentication phase. Once the authentication is complete, all the PCs can communicate after the MAC learning occurs.

The configuration for the port connecting to the hub is as follows:

On checking the show dot1x interface detail, we see the following results:

We see that port ge-0/0/7, even though configured as access, is authenticating users from three different VLANs and these devices are able to communicate. Even though these devices are on three different VLANs, they are able to communicate because the ethernet-switching table there have a MAC-to-VLAN mapping.

A single access port is able to authenticate users from different VLANs because it is a MAC-based VLAN assignment.

The above example will not work if the VLAN assignment method is port based.

The output of the show dot1x interface detail command, in conjunction with the MAC-based VLAN assignment, might vary from vendor to vendor; and for Juniper the above illustrated example is the expected behavior.