Dell Brocade DCX, Configuration Manual

Page: 1006 / 1436

934 BigIron RX Series Configuration Guide
53-1001810-01
Configuring multi-device port authentication
31
A port can be removed from its RADIUS-assigned VLAN when any of the following occur:
•
The link goes down for the port
•
The MAC session is manually deleted with the mac-authentication clear-mac-session
command
•
The MAC address that caused the port to be dynamically assigned to a VLAN ages out
For example, say port 1/1 is currently in VLAN 100, to which it was assigned when MAC address
0007.eaa1.e90f was authenticated by a RADIUS server. The port was originally configured to be in
VLAN 111. If the MAC session for address 0007.eaa1.e90f is deleted, then port 1/1 is moved from
VLAN 100 back into VLAN 111.
You can optionally specify an alternate VLAN to which to move the port when the MAC session for
the address is deleted. For example, to place the port in the restricted VLAN, enter commands such
as the following.
BigIron RX(config)# interface e 3/1
BigIron RX(config-if-e100-3/1)# mac-auth move-back-to-old-vlan port-restrict-vlan
Syntax: [no] mac-authentication move-back-to-old-vlan disable | port-configured-vlan |
port-restrict-vlan | system-default-vlan
The disable keyword disables moving the port back to its original VLAN. The port would stay in its
RADIUS-assigned VLAN.
The port-configured-vlan keyword removes the port from its RADIUS-assigned VLAN and places it
back in the VLAN where it was originally assigned. This is the default.
The port-restrict-vlan keyword removes the port from its RADIUS-assigned VLAN and places it in the
restricted VLAN.
The system-default-vlan keyword removes the port from its RADIUS-assigned VLAN and places it in
the DEFAULT-VLAN.
Saving dynamic VLAN assignments to the running configuration file
You can configure the device to save the RADIUS-specified VLAN assignments to the device's
running configuration file. To do this, enter the following command.
BigIron RX(config)# mac-authentication save-dynamicvlan-to-config
Syntax: [no] mac-authentication save-dynamicvlan-to-config
By default, the dynamic VLAN assignments are not saved to the running configuration file. Entering
the show running-config command does not display dynamic VLAN assignments, although they can
be displayed with the show vlan and show auth-mac-address detail commands.
Clearing authenticated MAC addresses
The device maintains an internal table of the authenticated MAC addresses (viewable with the
show authenticated-mac-address command). You can clear the contents of the authenticated MAC
address table either entirely, or just for the entries learned on a specified interface. In addition, you
can clear the MAC session for an address learned on a specific interface.
To clear the entire contents of the authenticated MAC address table, enter the following command.
BigIron RX(config)# clear auth-mac-table