Extreme Networks ExtremeWare XOS 11.3, Manual

Page: 370 / 698

Network Login
ExtremeWare XOS 11.3 Concepts Guide
370
To remove a MAC address from the table, use the following command:
configure netlogin delete mac-list [<mac> {<mask>} | default]
Displaying the MAC Address List
To display the MAC address table, use the following command:
show netlogin mac-list
When a client needs authentication the best match will be used to authenticate to the server.
MAC-based authentication is VR aware, so there is one MAC list per VR.
Assume we have a supplicant with MAC address 00:04:96:05:40:00, and the switch has the following
table:
MAC Address/Mask Password (encrypted) Port(s)
-------------------- ---------------------- --------------
00:00:00:00:00:10/48 <not configured> 1:1-1:5
00:00:00:00:00:11/48 <not configured> 1:6-1:10
00:00:00:00:00:12/48 <not configured> any
00:01:30:70:0C:00/48 yaqu any
00:01:30:32:7D:00/48 ravdqsr any
00:04:96:00:00:00/24 <not configured> any
The user name used to authenticate against the Radius server would be “000496000000”, as this is the
supplicants MAC address with the configured mask applied.
Note that the commands are VR aware, and therefore one MAC list table exists per VR.
Secure MAC Configuration Example
The following configuration example shows how to configure secure MAC on your Extreme Networks
switch. To configure secure MAC, do the following:
●
Create a VLAN used for netlogin
●
Configure the VLAN for netlogin
●
Enable MAC-based netlogin on the switch
●
Enable MAC-based netlogin on the ports used for authentication
●
Specify one or more ports to accept authentication requests from a specific MAC address
In the following example, authentication requests from MAC address:
●
00:00:00:00:00:10 are only accepted on ports 1:1 through 1:5
●
00:00:00:00:00:11 are only accepted on ports 1:6 through 1:10
●
00:00:00:00:00:12 are accepted on all other ports
create vlan nlvlan
configure netlogin vlan nlvlan
enable netlogin mac
enable netlogin ports 1:1-1:10 mac
configure netlogin add mac-list 00:00:00:00:00:10 ports 1:1-1:5
configure netlogin add mac-list 00:00:00:00:00:11 ports 1:6-1:10
configure netlogin add mac-list 00:00:00:00:00:12