Brocade FastIron Ethernet Switch Security Configuration Gu Manual de usuario descargar pdf (Pagina 264)

• Enabling dynamic VLAN support for tagged packets on non-member VLAN ports is not supported

on FWS and FCX devices.

• The mac-authentication disable-ingress-filtering command is not available on the ICX 6610 and

ICX 6450 platforms.

Specifying to which VLAN a port is moved after its RADIUS-specified VLAN assignment expires

When a port is dynamically assigned to a VLAN through the authentication of a MAC address, and the

MAC session for that address is deleted on the Brocade device, then by default the port is removed

from its RADIUS-assigned VLAN and placed back in the VLAN where it was originally assigned.

A port can be removed from its RADIUS-assigned VLAN when any of the following occur:

• The link goes down for the port

• The MAC session is manually deleted with the mac-authentication clear-mac-session command

• The MAC address that caused the port to be dynamically assigned to a VLAN ages out

For example, say port 1/1 is currently in VLAN 100, to which it was assigned when MAC address

0000.00a1.e90f was authenticated by a RADIUS server. The port was originally configured to be in

VLAN 111. If the MAC session for address 0000.00a1.e90f is deleted, then port 1/1 is moved from

VLAN 100 back into VLAN 111.

You can optionally specify an alternate VLAN to which to move the port when the MAC session for the

address is deleted. For example, to place the port in the restricted VLAN, enter commands such as the

following.

device(config)#interface e 3/1

device(config-if-e1000-3/1)#mac-auth move-back-to-old-vlan port-restrict-vlan

Syntax: [no] mac-authentication move-back-to-old-vlan [ port-restrict-vlan | port-configured-

vlan | system-default-vlan ]

The port-configured-vlan keyword removes the port from its RADIUS-assigned VLAN and places it

back in the VLAN where it was originally assigned. This is the default.

The port-restrict-vlan keyword removes the port from its RADIUS-assigned VLAN and places it in the

restricted VLAN.

The system-default-vlan keyword removes the port from its RADIUS-assigned VLAN and places it in

the DEFAULT-VLAN.

NOTE

When a MAC session is deleted, if the port is moved back to a VLAN that is different than the running-

config file, the system will update the running-config file to reflect the changes. This will occur even if

mac-authentication save-dynamicvlan-to-config" is not configured.

Automatic removal of dynamic VLAN assignments for MAC authenticated ports

NOTE

This feature is not supported on ICX 6610 and FCX devices.

By default, the Brocade device removes any association between a port and a dynamically-assigned

VLAN when all authenticated MAC sessions for that tagged or untagged VLAN have expired on the

port. Thus, RADIUS-specified VLAN assignments are not saved to the device running-config file.

When the show run command is issued during a session, dynamically-assigned VLANs are not

Specifying to which VLAN a port is moved after its RADIUS-specified VLAN assignment expires

264 FastIron Ethernet Switch Security Configuration Guide

53-1003088-03

1 2 ... 259 260 261 262 263 264 265 266 267 268 269 ... 395 396

Comentarios a estos manuales

Sin comentarios

Brocade FastIron Ethernet Switch Security Configuration Gu Manual de usuario Pagina 264

Comentarios a estos manuales

Relacionado con productos y manuales para Accesorios De Computador Brocade FastIron Ethernet Switch Security Configuration Gu