Brocade Communications Systems Brocade ICX 6650 6650 - Manual (Page 281)

Brocade ICX 6650 Security Configuration Guide 261
53-1002601-01
Example port authentication configurations
FIGURE 10 Using multi-device port authentication with dynamic VLAN assignment
In this example, multi-device port authentication is performed for both devices. If the PC is
successfully authenticated, port e1 PVID is changed from VLAN 1 (the DEFAULT-VLAN) to VLAN 102.
If authentication for the PC fails, then the PC can be placed in a specified “restricted” VLAN, or
traffic from the PC can be blocked in hardware. In this example, if authentication for the PC fails,
the PC would be placed in VLAN 1023, the restricted VLAN.
If authentication for the IP phone is successful, then port e1/1/1 is added to VLAN 3. If
authentication for the IP phone fails, then traffic from the IP phone would be blocked in hardware.
(Devices sending tagged traffic cannot be placed in the restricted VLAN.)
The portion of the running-config related to multi-device port authentication is as follows.
mac-authentication enable
mac-authentication auth-fail-vlan-id 1023
interface ethernet 1
dual-mode
mac-authentication enable
mac-authentication auth-fail-action restrict-vlan
mac-authentication enable-dynamic-vlan
mac-authentication disable-ingress-filtering
The mac-authentication disable-ingress-filtering command enables tagged packets on the port,
even if the port is not a member of the VLAN. If this feature is not enabled, authentication works as
in
“Example 1— Multi-device port authentication with dynamic VLAN assignment”
Hub
Brocade Switch
Port e1/1/1
Hub
Untagged
Tagged
RADIUS Server
Tunnel-Private-Group-ID:
User 0000.007f.2e0a -> “U:102”
User 0000.008e.86ac -> “T:3”
PC
MAC: 0000.007f.2e0a
IP Phone
MAC: 0000.008e.86ac