assignement

hello, to sum up my case. 1) radius authenticate user in users file 2) my client is windows xp wired 3) successfull vlan is set to 100 Tunnel-Type = VLAN, Tunnel-Medium-type = IEEE-802, Tunnel-Private-Group-ID = 100 so, if auth successed the switch assign to vlan100 , it works. (fa0/24) but if auth fails, i'd like to send him to vlan 120 so in my fa0/24 i did: interface FastEthernet0/24 switchport access vlan 100 switchport mode access dot1x pae authenticator dot1x port-control auto dot1x auth-fail vlan 120 => here supposed to send it to vlan 120 spanning-tree portfast BUT, in case of auth failed, it doesn't work Anybody can help me?