Brocade Communications Systems Brocade ICX 6650 6650 Manuel D’Utilisation
248
Brocade ICX 6650 Security Configuration Guide
53-1002601-01
Multi-device port authentication configuration
To clear the authenticated MAC address table of entries learned on a specified interface, enter a
command such as the following.
command such as the following.
Brocade# clear auth-mac-table ethernet 1/3/1
Syntax: clear auth-mac-table ethernet port
Specify the port variable in stack-unit/slotnum/portnum format.
To clear the MAC session for an address learned on a specific interface, enter commands such as
the following.
the following.
Brocade(config)# interface ethernet 1/3/1
Brocade(config-if-e10000-1/3/1)# mac-authentication clear-mac-session
00e0.1234.abd4
Brocade(config-if-e10000-1/3/1)# mac-authentication clear-mac-session
00e0.1234.abd4
Syntax: mac-authentication clear-mac-session mac-address
This command removes the Layer 2 CAM entry created for the specified MAC address. If the
Brocade device receives traffic from the MAC address again, the MAC address is authenticated
again.
Brocade device receives traffic from the MAC address again, the MAC address is authenticated
again.
NOTE
In a configuration with multi-device port authentication and 802.1X authentication on the same
port, the mac-authentication clear-mac-session command will clear the MAC session, as well as its
respective 802.1X session, if it exists.
In a configuration with multi-device port authentication and 802.1X authentication on the same
port, the mac-authentication clear-mac-session command will clear the MAC session, as well as its
respective 802.1X session, if it exists.
Disabling aging for authenticated MAC addresses
MAC addresses that have been authenticated or denied by a RADIUS server are aged out if no
traffic is received from the MAC address for a certain period of time:
traffic is received from the MAC address for a certain period of time:
•
Authenticated MAC addresses or non-authenticated MAC addresses that have been placed in
the restricted VLAN are aged out if no traffic is received from the MAC address over the device
normal MAC aging interval.
the restricted VLAN are aged out if no traffic is received from the MAC address over the device
normal MAC aging interval.
•
Non-authenticated MAC addresses that are blocked by the device are aged out if no traffic is
received from the address over a fixed hardware aging period (70 seconds), plus a
configurable software aging period. (Refer to the next section for more information on
configuring the software aging period).
received from the address over a fixed hardware aging period (70 seconds), plus a
configurable software aging period. (Refer to the next section for more information on
configuring the software aging period).
You can optionally disable aging for MAC addresses subject to authentication, either for all MAC
addresses or for those learned on a specified interface.
addresses or for those learned on a specified interface.
Globally disabling aging of MAC addresses
On most devices, you can disable aging for all MAC addresses on all interfaces where multi-device
port authentication has been enabled by entering the mac-authentication disable-aging command.
port authentication has been enabled by entering the mac-authentication disable-aging command.
Brocade(config)# mac-authentication disable-aging
Syntax: mac-authentication disable-aging
Enter the command at the global or interface configuration level.