Extreme Networks ExtremeWare 7.7, Command Reference Manual

Page: 1036 / 2620

1036 ExtremeWare 7.7 Command Reference Guide
Security Commands
enable netlogin ports mac
enable netlogin ports <portlist> mac
Description
Enables MAC-based authentication for network login on the specified ports.
Syntax Description
Default
By default, MAC-based authentication for network login is disabled.
Usage Guidelines
MAC-based RADIUS authentication uses the MAC address of the client for authentication. This feature
is useful for devices that cannot function as 802.1x supplicants, such as IP phones. RADIUS is used as
the transport protocol for authentication.
Before MAC-based RADIUS authentication is enabled, the RADIUS server must be populated with the
MAC addresses of all clients or with a MAC address and a mask. To add MAC address/mask pairs to
the table used for MAC-based network login authentication, use the following command:
configure netlogin mac-address
When a new MAC address is detected on a port that is enabled for MAC-based network login, the
RADIUS client sends an authentication message (RADIUS access-request) to the RADIUS server for
validation. The RADIUS client tries the configured maximum number of retries to validate the
supplicant. To configure the maximum number of retries, use the following command:
configure netlogin mac auth-retry-count
While a port is in an authenticated state, the reauthentication mechanism periodically sends a RADIUS
Access-Request message to the RADIUS server to reauthenticate the port. To specify the number of
seconds between successive reauthentication messages, use the following command:
configure netlogin mac reauth-period
Example
The following command enables MAC-based network login on port 9:
enable netlogin ports 9 mac
History
This command was first available in ExtremeWare 7.4.
Platform Availability
This command is available on all platforms.
portlist Specifies the ports for which MAC-based network login should be enabled.