Brocade Communications Systems Brocade ICX 6650 6650 User Manual
Page 262
242
Brocade ICX 6650 Security Configuration Guide
53-1002601-01
Multi-device port authentication configuration
Configuration notes and limitations
•
This feature works in conjunction with multi-device port authentication with dynamic VLAN
assignment only. If this feature is not enabled, authentication works as in
Multi-device port authentication with dynamic VLAN assignment”
•
The port on which ingress filtering is disabled must be tagged to a VLAN.
•
If a host sends both tagged and untagged traffic, and ingress filtering is disabled on the port,
the port must be configured as a dual-mode port.
Specifying to which VLAN a port is moved after its RADIUS-specified VLAN
assignment expires
When a port is dynamically assigned to a VLAN through the authentication of a MAC address, and
the MAC session for that address is deleted on the Brocade device, then by default the port is
removed from its RADIUS-assigned VLAN and placed back in the VLAN where it was originally
assigned.
A port can be removed from its RADIUS-assigned VLAN when any of the following occur:
•
The link goes down for the port
•
The MAC session is manually deleted with the mac-authentication clear-mac-session
command
•
The MAC address that caused the port to be dynamically assigned to a VLAN ages out
For example, say port 1/1/1 is currently in VLAN 100, to which it was assigned when MAC address
0007.eaa1.e90f was authenticated by a RADIUS server. The port was originally configured to be in
VLAN 111. If the MAC session for address 0007.eaa1.e90f is deleted, then port 1/1/1 is moved
from VLAN 100 back into VLAN 111.
You can optionally specify an alternate VLAN to which to move the port when the MAC session for
the address is deleted. For example, to place the port in the restricted VLAN, enter commands such
as the following.
Brocade(config)# interface ethernet 1/3/1
Brocade(config-if-e10000-1/3/1)# mac-auth move-back-to-old-vlan
port-restrict-vlan
Syntax: [no] mac-authentication move-back-to-old-vlan port-restrict-vlan| port-configured-vlan |
system-default-vlan
The port-configured-vlan keyword removes the port from its RADIUS-assigned VLAN and places it
back in the VLAN where it was originally assigned. This is the default.
The port-restrict-vlan keyword removes the port from its RADIUS-assigned VLAN and places it in the
restricted VLAN.
The system-default-vlan keyword removes the port from its RADIUS-assigned VLAN and places it in
the DEFAULT-VLAN.
NOTE
When a MAC session is deleted, if the port is moved back to a VLAN that is different than the running-
config file, the system will update the running-config file to reflect the changes. This will occur even
if mac-authentication save-dynamicvlan-to-config" is not configured.