41-5
Catalyst 6500 Series Switch Software Configuration Guide—Release 8.7
OL-8978-04
Chapter 41 Configuring MAC Authentication Bypass
MAC Authentication Bypass Configuration Guidelines and Restrictions
•
8
02.1X—
MAC authentication bypass is an independent feature but when used in combination with
802.1X, acts as a fallback for authenticating MAC addresses. When both MAC authentication
bypass and 802.1X are configured on a port, the port tries to authenticate using 802.1X. If the host
does not respond to the EAPOL requests, instead of continuing the authentication attempts, the
802.1X port is moved to the MAC authentication bypass state, where the authentication is attempted
using MAC authentication bypass.
•
A
uthentication failure VLAN—
When 802.1X authentication fails, irrespective of whether MAC
authentication bypass is configured, if the authentication failure VLAN is configured, the port is
moved to the authentication failure VLAN. The authentication failure VLAN is only for 802.1X
authentication failed users and not a generic authentication failure VLAN for MAC authentication
bypass. For more information on the authentication failure VLAN, see the
“Configuring the
Authentication Failure VLAN” section on page 40-38
.
•
Guest VLAN—The 802.1X guest VLAN and MAC authentication bypass work together but with
some changes to the existing guest VLAN behavior. When both the MAC authentication bypass and
the guest VLAN are configured and no Extensible Authentication Protocol over LAN
(
EAPOL)
packets are received on a port, the 802.1X state machine is moved to the MAC authentication bypass
state where it puts the port to forwarding in the native VLAN and disables learning. If the guest
VLAN is not configured, the port remains in the MAC authentication bypass state where it waits for
a MAC address on the port. For more information on guest VLANs, see the
“Understanding How
802.1X Authentication for the Guest VLAN Works” section on page 40-9
.
•
Port security—When a new MAC address is redirected, the MAC authentication bypass function
sees the MAC address before port security. If the MAC address is successfully authenticated, the
port security feature is informed of the newly learned MAC address. In the inband path, the MAC
authentication bypass function starts before any port security functions begin.
•
Auxiliary VLANs—MAC authentication bypass is supported with auxiliary (voice) VLANs. MAC
authentication bypass is restricted to those MAC addresses that appear on the port VLAN only. All
IP phone MAC addresses that are learned through Cisco Discovery Protocol (CDP) are allowed on
the auxiliary VLAN.
•
Dynamic ARP Inspection (D
AI)—Works with MAC authentication bypass
.
•
VLAN Membership Policy Server (VMPS)—MAC authentication bypass and VMPS are mutually
exclusive features. The CLI prevents you from configuring both features at the same time.
•
LAN port IP—When you configure both MAC authentication bypass and LAN port IP, the MAC
authentication bypass function runs first. After authentication, the MAC authentication bypass
feature triggers the LAN port IP function. The hosts in the LAN port IP exception list are
authenticated using MAC authentication bypass (if configured) before access is provided.
•
Web-based proxy authentication— When both MAC authentication bypass and web-based proxy
authentication are configured on an interface, MAC authentication bypass starts before the
web-based proxy authentication because MAC authentication bypass is a feature in Layer 2. A
feature in Layer 2 is always attempted before a feature in Layer 3.
•
RADIUS accounting—RADIUS accounting is supported.
•
SNMP support—All required set and get calls are exported to SNMP. The SNMP support for MAC
authentication bypass is scheduled for a future software release.
•
High availability—High availability is supported. The MAC authentication bypass initial state and
end state (authorized and unauthorized) of the port are synchronized to the standby supervisor
engine. Intermediate states are not synchronized.
