When a supplicant (login program) is connected to a switch port, the port issues an 802.1X authentication request to the attached 802.1X supplicant. The supplicant replies with the given username and password, and an authentication request is then passed to a configured RADIUS server.

The authentication server's user database supports Extended Authentication Protocol (EAP), which allows particular guest VLAN memberships to be defined based on each individual user. After authorization, the port connected to the authenticated supplicant then becomes a member of the specified guest VLAN. When the supplicant is successfully authenticated, traffic is automatically assigned to the guest VLAN.