Brocade Communications Systems Brocade ICX 6650 6650 - Manual (Page 269)

Brocade ICX 6650 Security Configuration Guide 249
53-1002601-01
Multi-device port authentication configuration
The denied-only parameter prevents denied sessions from being aged out, but ages out permitted
sessions.
The permitted-only parameter prevents permitted (authenticated and restricted) sessions from
being aged out and ages denied sessions.
Disabling the aging of MAC addresses on interfaces
To disable aging for all MAC addresses subject to authentication on a specific interface where
multi-device port authentication has been enabled, enter the command at the interface level.
Example
Brocade(config)# interface ethernet 1/3/1
Brocade(config-if-e10000-1/3/1)# mac-authentication disable-aging
Syntax: [no] mac-authentication disable-aging
Changing the hardware aging period for blocked
MAC addresses
When the Brocade device is configured to drop traffic from non-authenticated MAC addresses,
traffic from the blocked MAC addresses is dropped in hardware, without being sent to the CPU. A
Layer 2 hardware entry is created that drops traffic from the MAC address in hardware. If no traffic
is received from the MAC address for a certain amount of time, this Layer 2 hardware entry is aged
out. If traffic is subsequently received from the MAC address, then an attempt can be made to
authenticate the MAC address again.
Aging of the Layer 2 hardware entry for a blocked MAC address occurs in two phases, known as
hardware aging and software aging.
On Brocade ICX 6650 devices, the hardware aging period for blocked MAC addresses is fixed at 70
seconds and is non-configurable. (The hardware aging time for non-blocked MAC addresses is the
length of time specified with the mac-age command.) The software aging period for blocked MAC
addresses is configurable through the CLI, with the mac-authentication max-age command. After
the hardware aging period ends, the software aging period begins. When the software aging period
ends, the blocked MAC address ages out, and can be authenticated again if the Brocade device
receives traffic from the MAC address.
To change the hardware aging period for blocked MAC addresses, enter a command such as the
following.
Brocade(config)# mac-authentication hw-deny-age 10
Syntax: [no] mac-authentication hw-deny-age num
The num parameter is a value from 1 to 65535 seconds. The default is 70 seconds.