BigIron RX Series Configuration Guide
927
53-1001810-01
Chapter
31
Configuring Multi-Device Port Authentication
In this chapter
•
How multi-device port authentication works . . . . . . . . . . . . . . . . . . . . . . . . 927
•
Configuring multi-device port authentication . . . . . . . . . . . . . . . . . . . . . . . 929
•
Displaying multi-device port authentication information . . . . . . . . . . . . . . 936
How multi-device port authentication works
Multi-device port authentication
is a way to configure a BigIron RX to forward or block traffic from a
MAC address based on information received from a RADIUS server. Multi-device port
authentication is supported in the device software release 02.2.01 and later.
The multi-device port authentication feature is a mechanism by which incoming traffic originating
from a specific MAC address is switched or forwarded by the device only if the source MAC address
is successfully authenticated by a RADIUS server. The MAC address itself is used as the username
and password for RADIUS authentication; the user does not need to provide a specific username
and password to gain access to the network. If RADIUS authentication for the MAC address is
successful, traffic from the MAC address is forwarded in hardware.
If the RADIUS server cannot validate the user's MAC address, then it is considered an
authentication failure, and a specified authentication-failure action can be taken. The default
authentication-failure action is to drop traffic from the non-authenticated MAC address in
hardware. You can also configure the device to move the port on which the non-authenticated MAC
address was learned into a restricted or “guest” VLAN, which may have limited access to the
network.
RADIUS authentication
The multi-device port authentication feature communicates with the RADIUS server to authenticate
a newly found MAC address. The device supports multiple RADIUS servers; if communication with
one of the RADIUS servers times out, the others are tried in sequential order. If a response from a
RADIUS server is not received within a specified time (by default, 3 seconds) the RADIUS session
times out, and the device retries the request up to three times. If no response is received, the next
RADIUS server is chosen, and the request is sent for authentication.
The RADIUS server is configured with the usernames and passwords of authenticated users. For
multi-device port authentication, the username and password is the MAC address itself; that is, the
device uses the MAC address for both the username and the password in the request sent to the
RADIUS server. For example, given a MAC address of 0007e90feaa1, the users file on the RADIUS
server would be configured with a username and password both set to 0007e90feaa1. When
Содержание Brocade DCX
Страница 40: ...xl BigIron RX Series Configuration Guide 53 1001810 01 ...
Страница 72: ...lxxii BigIron RX Series Configuration Guide 53 1001810 01 ...
Страница 88: ...16 BigIron RX Series Configuration Guide 53 1001810 01 Searching and filtering output 1 ...
Страница 300: ...228 BigIron RX Series Configuration Guide 53 1001810 01 Displaying IP information 7 ...
Страница 318: ...246 BigIron RX Series Configuration Guide 53 1001810 01 Deploying a LAG 8 ...
Страница 418: ...346 BigIron RX Series Configuration Guide 53 1001810 01 SuperSpan 12 ...
Страница 482: ...410 BigIron RX Series Configuration Guide 53 1001810 01 MRP CLI example 14 ...
Страница 506: ...434 BigIron RX Series Configuration Guide 53 1001810 01 Displaying VSRP information 15 ...
Страница 566: ...494 BigIron RX Series Configuration Guide 53 1001810 01 QoS for the oversubscribed 16 x 10GE modules 18 ...
Страница 582: ...510 BigIron RX Series Configuration Guide 53 1001810 01 Viewing Layer 2 ACLs 20 ...
Страница 634: ...562 BigIron RX Series Configuration Guide 53 1001810 01 Troubleshooting ACLs 21 ...
Страница 642: ...570 BigIron RX Series Configuration Guide 53 1001810 01 Trunk formation 22 ...
Страница 746: ...674 BigIron RX Series Configuration Guide 53 1001810 01 Displaying RIP filters 24 ...
Страница 808: ...736 BigIron RX Series Configuration Guide 53 1001810 01 Displaying OSPF information 25 ...
Страница 926: ...854 BigIron RX Series Configuration Guide 53 1001810 01 Generalized TTL security mechanism support 26 ...
Страница 938: ...866 BigIron RX Series Configuration Guide 53 1001810 01 Displaying MBGP information 27 ...
Страница 950: ...878 BigIron RX Series Configuration Guide 53 1001810 01 Using secure copy 28 ...
Страница 988: ...916 BigIron RX Series Configuration Guide 53 1001810 01 Clearing IS IS information 29 ...
Страница 998: ...926 BigIron RX Series Configuration Guide 53 1001810 01 Configuring BFD for the specified protocol 30 ...
Страница 1014: ...942 BigIron RX Series Configuration Guide 53 1001810 01 Displaying multi device port authentication information 31 ...
Страница 1054: ...982 BigIron RX Series Configuration Guide 53 1001810 01 Sample 802 1x configurations 33 ...
Страница 1072: ...1000 BigIron RX Series Configuration Guide 53 1001810 01 IP source guard 35 Syntax show ip source guard ethernet port num ...
Страница 1108: ...1036 BigIron RX Series Configuration Guide 53 1001810 01 sFlow 39 ...
Страница 1190: ...1118 BigIron RX Series Configuration Guide 53 1001810 01 Displaying RIPng information 44 ...
Страница 1270: ...1198 BigIron RX Series Configuration Guide 53 1001810 01 Displaying ACLs 47 ...
Страница 1310: ...1238 BigIron RX Series Configuration Guide 53 1001810 01 Displaying OSPFv3 information 48 ...
Страница 1382: ...1310 BigIron RX Series Configuration Guide 53 1001810 01 Commands That Require a Reload D ...
Страница 1435: ...BigIron RX Series Configuration Guide 1363 53 1001810 01 VSRP E ...
Страница 1436: ...1364 BigIron RX Series Configuration Guide 53 1001810 01 VSRP E ...