Brocade Communications Systems Brocade ICX 6650 6650 Manuel D’Utilisation

Multi-device port authentication configuration

Specifying the format of the MAC addresses sent to the
RADIUS server

When multi-device port authentication is configured, the Brocade device authenticates MAC 
addresses by sending username and password information to a RADIUS server. The username and 
password is the MAC address itself; that is, the device uses the MAC address for both the 
username and the password in the request sent to the RADIUS server. 

By default, the MAC address is sent to the RADIUS server in the format xxxxxxxxxxxx. You can 
optionally configure the device to send the MAC address to the RADIUS server in the format 
xx-xx-xx-xx-xx-xx, or the format xxxx.xxxx.xxxx. To do this, enter a command such as the following.

Brocade(config)# mac-authentication auth-passwd-format xxxx.xxxx.xxxx

Syntax: [no] mac-authentication auth-passwd-format xxxx.xxxx.xxxx | xx-xx-xx-xx-xx-xx | 

xxxxxxxxxxxx

Specifying the authentication-failure action

When RADIUS authentication for a MAC address fails, you can configure the device to perform one 
of two actions:

•

Drop traffic from the MAC address in hardware (the default)

•

Move the port on which the traffic was received to a restricted VLAN

To configure the device to move the port to a restricted VLAN when multi-device port authentication 
fails, enter commands such as the following.

Brocade(config)# interface ethernet 1/3/1
Brocade(config-if-e10000-1/3/1)# mac-authentication auth-fail-action 
restrict-vlan 100

Syntax: [no] mac-authentication auth-fail-action restrict-vlan [vlan-id]

If the ID for the restricted VLAN is not specified at the interface level, the global restricted VLAN ID 
applies for the interface.

To specify the VLAN ID of the restricted VLAN globally, enter the following command.

Brocade(config)# mac-authentication auth-fail-vlan-id 200

Syntax: [no] mac-authentication auth-fail-vlan-id vlan-id

The command above applies globally to all MAC-authentication-enabled interfaces.

Note that the restricted VLAN must already exist on the device. You cannot configure the restricted 
VLAN to be a non-existent VLAN. If the port is a tagged or dual-mode port, you cannot use a 
restricted VLAN as the authentication-failure action.

To configure the device to drop traffic from non-authenticated MAC addresses in hardware, enter 
commands such as the following.

Brocade(config)# interface ethernet 1/3/1
Brocade(config-if-e10000-1/3/1)# mac-authentication auth-fail-action 
block-traffic