Brocade Multi-Service IronWare Security Configuration Guide (Supporting R05.6.00) - Manual (Page 293)

Multi-Service IronWare Security Configuration Guide 275
53-1003035-02
Configuring multi-device port authentication
6
Brocade(config)# interface e 3/1
Brocade(config-if-e100-3/1)# mac-authentication auth-fail-action block-traffic
Syntax: [no] mac-authentication auth-fail-action block-traffic
Dropping traffic from non-authenticated MAC addresses is the default behavior when multi-device
port authentication is enabled.
Defining MAC address filters
You can specify MAC addresses that do not have to go through multi-device port authentication.
These MAC addresses are considered pre-authenticated, and are not subject to RADIUS
authentication. To do this, you can define MAC address filters that specify the MAC addresses to
exclude from multi-device port authentication.
You should use a MAC address filter when the RADIUS server itself is connected to an interface
where multi-device port authentication is enabled. If a MAC address filter is not defined for the MAC
address of the RADIUS server and applied on the interface, the RADIUS authentication process
would fail since the device would drop all packets from the RADIUS server itself.
For example, the following command defines a MAC address filter for address 0000.0058.aca4.
Brocade(config)# mac-authentication mac-filter 1 permit 0000.0058.aca4
Syntax: [no] mac-authentication mac-filter filter
The following commands apply the MAC address filter on an interface so that address
0010.dc58.aca4 is excluded from multi-device port authentication.
Brocade(config)# interface e 3/1
Brocade(config-if-e100-3/1)# mac-authentication apply-mac-auth-filter 1
Syntax: [no] mac-authentication apply-mac-auth-filter filter-id
Configuring dynamic VLAN assignment
An interface can be dynamically assigned to a VLAN based on the MAC address learned on that
interface. When a MAC address is successfully authenticated, the RADIUS server sends the device
a RADIUS Access-Accept message that allows the device to forward traffic from that MAC address.
The RADIUS Access-Accept message can also contain attributes set for the MAC address in its
access profile on the RADIUS server.
If one of the attributes in the Access-Accept message specifies a VLAN identifier, and this VLAN is
available on the device, the port is moved from its default VLAN to the specified VLAN.
To enable dynamic VLAN assignment for authenticated MAC addresses, you must add the following
attributes to the profile for the MAC address on the RADIUS server (dynamic VLAN assignment on
multi-device port authentication-enabled interfaces is enabled by default and can be disabled).
Refer to
“Dynamic VLAN and ACL assignments” for a list of the attributes that must be set on the
RADIUS server
Dynamic VLAN assignment on a multi-device port authentication-enabled interface is enabled by
default. If it is disabled, enter commands such as the following command to enable it.
Brocade(config)# interface e 3/1
Brocade(config-if-e100-3/1)# mac-authentication enable-dynamic-vlan
Syntax: [no] mac-authentication enable-dynamic-vlan