Configuration Guide User guide

1856 FastIron Configuration Guide
53-1002494-02
Multi-device port authentication configuration
Example of enabling multi-device port authentication on an interface
Brocade(config)#interface e 3/1
Brocade(config-if-e1000-3/1)#mac-authentication enable
Syntax: [no] mac-authentication enable
You can also configure multi-device port authentication commands on a range of interfaces.
Example of enabling multi-device port authentication on a range of interfaces
Brocade(config)#int e 3/1 to 3/12
Brocade(config-mif-3/1-3/12)#mac-authentication enable
Specifying the format of the MAC addresses sent to the
RADIUS server
When multi-device port authentication is configured, the Brocade device authenticates MAC
addresses by sending username and password information to a RADIUS server. The username and
password is the MAC address itself; that is, the device uses the MAC address for both the
username and the password in the request sent to the RADIUS server.
By default, the MAC address is sent to the RADIUS server in the format xxxxxxxxxxxx. You can
optionally configure the device to send the MAC address to the RADIUS server in the format
xx-xx-xx-xx-xx-xx, or the format xxxx.xxxx.xxxx. To do this, enter a command such as the following.
Brocade(config)#mac-authentication auth-passwd-format xxxx.xxxx.xxxx
Syntax: [no] mac-authentication auth-passwd-format xxxx.xxxx.xxxx | xx-xx-xx-xx-xx-xx |
xxxxxxxxxxxx
Specifying the authentication-failure action
When RADIUS authentication for a MAC address fails, you can configure the device to perform one
of two actions:
• Drop traffic from the MAC address in hardware (the default)
• Move the port on which the traffic was received to a restricted VLAN
To configure the device to move the port to a restricted VLAN when multi-device port authentication
fails, enter commands such as the following.
Brocade(config)#interface e 3/1
Brocade(config-if-e1000-3/1)#mac-authentication auth-fail-action restrict-vlan
100
Syntax: [no] mac-authentication auth-fail-action restrict-vlan [<vlan-id>]
If the ID for the restricted VLAN is not specified at the interface level, the global restricted VLAN ID
applies for the interface.
To specify the VLAN ID of the restricted VLAN globally, enter the following command.
Brocade(config)#mac-authentication auth-fail-vlan-id 200
Syntax: [no] mac-authentication auth-fail-vlan-id <vlan-id>
The command above applies globally to all MAC-authentication-enabled interfaces.