BigIron RX Series Configuration Guide
971
53-1001810-01
Configuring 802.1x port security
33
•
Disabling aging for dot1x-mac-sessions
•
Configure aging time for blocked Clients
•
Clear the dot1x-mac-session for a MAC address
Specifying the authentication-failure action
In an 802.1x multiple client configuration, if RADIUS authentication for a Client is unsuccessful,
traffic from that Client is either dropped in hardware (the default), or the Client’s port is placed in a
“restricted” VLAN. You can specify which of these two authentication-failure actions is to be used.
If the authentication-failure action is to place the port in a restricted VLAN, you can specify the ID of
the restricted VLAN.
To specify that the authentication-failure action is to place the Client’s port in a restricted VLAN,
enter the following command.
BigIron RX(config)# dot1x-enable
BigIron RX(config-dot1x)# auth-fail-action restricted-vlan
Syntax: [no] auth-fail-action restricted-vlan
To specify the ID of the restricted VLAN as VLAN 300, enter the following command.
BigIron RX(config-dot1x)# auth-fail-vlanid 300
Syntax: [no] auth-fail-vlanid
<vlan-id>
Specifying the number of authentication attempts the device
makes before dropping packets
When the authentication-failure action is to drop traffic from the Client, and the initial
authentication attempt made by the device to authenticate the Client is unsuccessful, the
BigIron
RX
immediately retries to authenticate the Client. After three unsuccessful authentication
attempts, the Client’s dot1x-mac-session is set to “access-denied”, causing traffic from the Client
to be dropped in hardware.
You can optionally configure the number of authentication attempts the device makes before
dropping traffic from the Client. To do so, enter a command such as the following.
BigIron RX(config-dot1x)# auth-fail-max-attempts 2
Syntax: [no] auth-fail-max-attempts
<attempts>
By default, the device makes 3 attempts to authenticate a Client before dropping packets from the
Client. You can specify between 1 – 10 authentication attempts.
Display commands
The show port security global-deny command lists all the configured global deny MAC addresses.
The show port security denied mac command lists all the denied MAC addresses in the system.
Clearing a dot1x-mac-session for a MAC address
You can clear the dot1x-mac-session for a specified MAC address, so that the Client with that MAC
address can be re-authenticated by the RADIUS server. For example.
BigIron RX# clear dot1x mac-session 00e0.1234.abd4
Содержание Brocade DCX
Страница 40: ...xl BigIron RX Series Configuration Guide 53 1001810 01 ...
Страница 72: ...lxxii BigIron RX Series Configuration Guide 53 1001810 01 ...
Страница 88: ...16 BigIron RX Series Configuration Guide 53 1001810 01 Searching and filtering output 1 ...
Страница 300: ...228 BigIron RX Series Configuration Guide 53 1001810 01 Displaying IP information 7 ...
Страница 318: ...246 BigIron RX Series Configuration Guide 53 1001810 01 Deploying a LAG 8 ...
Страница 418: ...346 BigIron RX Series Configuration Guide 53 1001810 01 SuperSpan 12 ...
Страница 482: ...410 BigIron RX Series Configuration Guide 53 1001810 01 MRP CLI example 14 ...
Страница 506: ...434 BigIron RX Series Configuration Guide 53 1001810 01 Displaying VSRP information 15 ...
Страница 566: ...494 BigIron RX Series Configuration Guide 53 1001810 01 QoS for the oversubscribed 16 x 10GE modules 18 ...
Страница 582: ...510 BigIron RX Series Configuration Guide 53 1001810 01 Viewing Layer 2 ACLs 20 ...
Страница 634: ...562 BigIron RX Series Configuration Guide 53 1001810 01 Troubleshooting ACLs 21 ...
Страница 642: ...570 BigIron RX Series Configuration Guide 53 1001810 01 Trunk formation 22 ...
Страница 746: ...674 BigIron RX Series Configuration Guide 53 1001810 01 Displaying RIP filters 24 ...
Страница 808: ...736 BigIron RX Series Configuration Guide 53 1001810 01 Displaying OSPF information 25 ...
Страница 926: ...854 BigIron RX Series Configuration Guide 53 1001810 01 Generalized TTL security mechanism support 26 ...
Страница 938: ...866 BigIron RX Series Configuration Guide 53 1001810 01 Displaying MBGP information 27 ...
Страница 950: ...878 BigIron RX Series Configuration Guide 53 1001810 01 Using secure copy 28 ...
Страница 988: ...916 BigIron RX Series Configuration Guide 53 1001810 01 Clearing IS IS information 29 ...
Страница 998: ...926 BigIron RX Series Configuration Guide 53 1001810 01 Configuring BFD for the specified protocol 30 ...
Страница 1014: ...942 BigIron RX Series Configuration Guide 53 1001810 01 Displaying multi device port authentication information 31 ...
Страница 1054: ...982 BigIron RX Series Configuration Guide 53 1001810 01 Sample 802 1x configurations 33 ...
Страница 1072: ...1000 BigIron RX Series Configuration Guide 53 1001810 01 IP source guard 35 Syntax show ip source guard ethernet port num ...
Страница 1108: ...1036 BigIron RX Series Configuration Guide 53 1001810 01 sFlow 39 ...
Страница 1190: ...1118 BigIron RX Series Configuration Guide 53 1001810 01 Displaying RIPng information 44 ...
Страница 1270: ...1198 BigIron RX Series Configuration Guide 53 1001810 01 Displaying ACLs 47 ...
Страница 1310: ...1238 BigIron RX Series Configuration Guide 53 1001810 01 Displaying OSPFv3 information 48 ...
Страница 1382: ...1310 BigIron RX Series Configuration Guide 53 1001810 01 Commands That Require a Reload D ...
Страница 1435: ...BigIron RX Series Configuration Guide 1363 53 1001810 01 VSRP E ...
Страница 1436: ...1364 BigIron RX Series Configuration Guide 53 1001810 01 VSRP E ...