Understanding Dynamic VLANs for 802.1X on EX-series Switches
Dynamic VLANs, in conjunction with the 802.1X authentication process, provide secure access to the LAN for supplicants belonging to different VLANs on a single port.
When this feature is configured, a supplicant becomes a member of a VLAN dynamically after 802.1X authentication is successful. Successful authentication requires that the VLAN ID or VLAN name exist on the switch and match the VLAN ID or VLAN name sent by the RADIUS server during authentication.
If the VLAN does not exist, the supplicant is unauthenticated. If a guest VLAN is established, the unauthenticated supplicant is automatically moved to the guest VLAN.