Brocade BigIron RX Series Configuration Guide - Manual (Page 1101)

BigIron RX Series Configuration Guide 1023
53-1002484-04
Example configurations
32
The mac-authentication disable-ingress-filtering command enables tagged packets on the port,
even if the port is not a member of the VLAN. If this feature is not enabled, authentication works as
in
“Example 2”
Example 2
Figure 131 illustrates multi-device port authentication with dynamic VLAN assignment on a
Brocade device. In this configuration, a PC and an IP phone are connected to a hub, which is
connected to port 2/1 on a Brocade device. Port 2/1 is configured as a dual-mode port. Also,
mac-authentication disable-ingress-filtering is enabled on the port. The profile for the PC MAC
address on the RADIUS server specifies that the PC should be dynamically assigned to VLAN 102,
and the RADIUS profile for the IP phone specifies that it should be dynamically assigned to VLAN 3.
FIGURE 131 Using multi-device port authentication with dynamic VLAN assignment
In this example, multi-device port authentication is performed for both devices. If the PC is
successfully authenticated, dual-mode port 2/1 PVID is changed from the VLAN 1 (the
DEFAULT-VLAN) to VLAN 102. If authentication for the PC fails, then the PC can be placed in a
specified “restricted” VLAN, or traffic from the PC can be blocked in hardware. In this example, if
authentication for the PC fails, the PC would be placed in VLAN 1023, the restricted VLAN.
If authentication for the IP phone is successful, then dual-mode port 2/1 is added to VLAN 3. If
authentication for the IP phone fails, then traffic from the IP phone would be blocked in hardware.
(Devices sending tagged traffic cannot be placed in the restricted VLAN.)
NOTE
This example assumes that the IP phone initially transmits untagged packets (for example, CDP or
DHCP packets), which trigger the authentication process on the Brocade device and client lookup
on the RADIUS server. If the phone sends only tagged packets and the port (2/1) is not a member
of that VLAN, authentication would not occur. In this case, port e1 must be added to that VLAN prior
to authentication.
Hub
FastIron Switch
Port e1
Hub
Untagged
Tagged
RADIUS Server
Tunnel-Private-Group-ID:
User 0002.3f7f.2e0a -> “U:102”
User 0050.048e.86ac -> “T:3”
PC
MAC: 0002.3f7f.2e0a
IP Phone
MAC: 0050.048e.86ac