79
Multi-VLAN mode
The MAC authentication multi-VLAN mode prevents an authenticated online user from service
interruption caused by VLAN changes on a port. When the port receives a packet sourced from the
user in a VLAN that does not match the existing MAC-VLAN mapping, the device does not logs off
the user or reauthenticates the user. The device creates a new MAC-VLAN mapping for the user,
and traffic transmission is not interrupted. The original MAC-VLAN mapping for the user remains on
the device until it dynamically ages out.
This feature improves transmission of data that is vulnerable to delay and interference. It is typically
applicable to IP phone users.
Periodic MAC reauthentication
Periodic MAC reauthentication tracks the connection status of online users, and updates the
authorization attributes assigned by the RADIUS server. The attributes include the ACL, VLAN, and
user profile-based QoS.
The device reauthenticates an online MAC authentication user periodically only after it receives the
termination action
Radius-request
from the authentication server for this user. The
Session-Timeout attribute (session timeout period) assigned by the server is the reauthentication
interval. To display the server-assigned Session-Timeout and Termination-Action attributes, use the
display mac-authentication connection
command. Support for the server configuration and
assignment of Session-Timeout and Termination-Action attributes depends on the server model.
When no server is reachable for MAC reauthentication, the device keeps the MAC authentication
users online or logs off the users, depending on the keep-online feature configuration on the device.
Keep-online
By default, the device logs off online MAC authentication users if no server is reachable for MAC
reauthentication. The keep-online feature keeps authenticated MAC authentication users online
when no server is reachable for MAC reauthentication.
In a fast-recovery network, you can use the keep-online feature to prevent MAC authentication users
from frequently coming online and going offline.
Port security
Overview
Port security combines and extends 802.1X and MAC authentication to provide MAC-based network
access control. Port security provides the following functions:
•
Prevents unauthorized access to a network by checking the source MAC addresses of inbound
traffic.
•
Prevents access to unauthorized devices or hosts by checking the destination MAC addresses
of outbound traffic.
•
Controls MAC address learning and authentication on a port to make sure the port learns only
source trusted MAC addresses.
A frame is illegal if its source MAC address cannot be learned in a port security mode or it is from a
client that has failed 802.1X or MAC authentication. The port security feature automatically takes a
predefined action on illegal frames. This automatic mechanism enhances network security and
reduces human intervention.
Authorization-fail-offline
The authorization-fail-offline feature logs off port security users who fail ACL or user profile
authorization.
A user fails ACL or user profile authorization in the following situations:
