Brocade Communications Systems Brocate Ethernet Access Switch 6910 - Manual (Page 255)

Brocade 6910 Ethernet Access Switch Configuration Guide 205
53-1002581-01
Network Access (MAC Address Authentication)
10
Command Usage
The maximum number of MAC addresses per port is 1024, and the maximum number of secure
MAC addresses supported for the switch system is 1024. When the limit is reached, all new MAC
addresses are treated as authentication failures.
Example
Console(config-if)#network-access max-mac-count 5
Console(config-if)#
network-access mode mac-authentication
Use this command to enable network access authentication on a port. Use the no form of this
command to disable network access authentication.
Syntax
[no] network-access mode mac-authentication
Default Setting
Disabled
Command Mode
Interface Configuration
Command Usage
• When enabled on a port, the authentication process sends a Password Authentication Protocol
(PAP) request to a configured RADIUS server. The user name and password are both equal to
the MAC address being authenticated.
• On the RADIUS server, PAP user name and passwords must be configured in the MAC address
format XX-XX-XX-XX-XX-XX (all in upper case).
• Authenticated MAC addresses are stored as dynamic entries in the switch secure MAC address
table and are removed when the aging time expires. The maximum number of secure MAC
addresses supported for the switch system is 1024.
• Configured static MAC addresses are added to the secure address table when seen on a
switch port. Static addresses are treated as authenticated without sending a request to a
RADIUS server.
• MAC authentication, 802.1X, and port security cannot be configured together on the same
port. Only one security mechanism can be applied.
• MAC authentication cannot be configured on trunk ports.
• When port status changes to down, all MAC addresses are cleared from the secure MAC
address table. Static VLAN assignments are not restored.
• The RADIUS server may optionally return a VLAN identifier list. VLAN identifier list is carried in
the “Tunnel-Private-Group-ID” attribute. The VLAN list can contain multiple VLAN identifiers in
the format “1u,2t,” where “u” indicates untagged VLAN and “t” tagged VLAN. The
“Tunnel-Type” attribute should be set to “VLAN,” and the “Tunnel-Medium-Type” attribute set to
“802.”