Brocade BigIron RX Series Configuration Guide - Manual (Page 1088)

1010 BigIron RX Series Configuration Guide
53-1002484-04
Configuring multi-device port authentication
32
BigIron RX(config)# interface e 3/1
BigIron RX(config-if-e100-3/1)# mac-authentication auth-fail-action restrict-vlan
100
Syntax: [no] mac-authentication auth-fail-action restrict-vlan [<vlan-id>]
If the ID for the restricted VLAN is not specified at the interface level, the global restricted VLAN ID
applies for the interface.
To specify the VLAN ID of the restricted VLAN globally, enter the following command.
BigIron RX(config)# mac-authentication auth-fail-vlan-id 200
Syntax: [no] mac-authentication auth-fail-vlan-id <vlan-id>
The command above applies globally to all MAC-authentication-enabled interfaces.
Note that the restricted VLAN must already exist on the device. You cannot configure the restricted
VLAN to be a non-existent VLAN. If the port is a tagged or dual-mode port, you cannot use a
restricted VLAN as the authentication-failure action.
To configure the device to drop traffic from non-authenticated MAC addresses in hardware, enter
commands such as the following.
BigIron RX(config)# interface e 3/1
BigIron RX(config-if-e100-3/1)# mac-authentication auth-fail-action block-traffic
Syntax: [no] mac-authentication auth-fail-action block-traffic
Dropping traffic from non-authenticated MAC addresses is the default behavior when multi-device
port authentication is enabled.
Defining MAC address filters
You can specify MAC addresses that do not have to go through multi-device port authentication.
These MAC addresses are considered pre-authenticated, and are not subject to RADIUS
authentication. To do this, you can define MAC address filters that specify the MAC addresses to
exclude from multi-device port authentication.
You should use a MAC address filter when the RADIUS server itself is connected to an interface
where multi-device port authentication is enabled. If a MAC address filter is not defined for the
MAC address of the RADIUS server and applied on the interface, the RADIUS authentication
process would fail since the device would drop all packets from the RADIUS server itself.
For example, the following command defines a MAC address filter for address 0010.dc58.aca4.
BigIron RX(config)# mac-authentication mac-filter 1 0010.dc58.aca4
Syntax: [no] mac-authentication mac-filter <filter>
The following commands apply the MAC address filter on an interface so that address
0010.dc58.aca4 is excluded from multi-device port authentication.
BigIron RX(config)# interface e 3/1
BigIron RX(config-if-e100-3/1)# mac-authentication apply-mac-auth-filter 1
Syntax: [no] mac-authentication apply-mac-auth-filter <filter-id>