Server; Specifying The Authentication-Failure Action - Dell PowerConnect B-RX Configuration Manual

NOTE
To implement 802.1x port security, at least one of the RADIUS servers identified to the BigIron RX
must support the 802.1x standard.
Supported RADIUS attributes
Many IEEE 802.1x Authenticators will function as RADIUS clients. Some of the RADIUS attributes
may be received as part of IEEE 802.1x authentication. The device supports the following RADIUS
attributes for IEEE 802.1x authentication:
•
•
•
•
•
•
•
Specifying the format of the MAC addresses sent to the RADIUS server
When multi-device port authentication is configured, the device authenticates MAC addresses by
sending username and password information to a RADIUS server. The username and password is
the MAC address itself; that is, the device uses the MAC address for both the username and the
password in the request sent to the RADIUS server.
By default, the MAC address is sent to the RADIUS server in the format xxxxxxxxxxxx. You can
optionally configure the device to send the MAC address to the RADIUS server in the format
xx-xx-xx-xx-xx-xx, or the format xxxx.xxxx.xxxx. To do this, enter a command such as the following.
BigIron RX(config)# mac-authentication auth-passwd-format xxxx.xxxx.xxxx
Syntax: [no] mac-authentication auth-passwd-format xxxx.xxxx.xxxx | xx-xx-xx-xx-xx-xx | xxxxxxxxxxxx

Specifying the authentication-failure action

When RADIUS authentication for a MAC address fails, you can configure the device to perform one
of two actions:
•
•
To configure the device to move the port to a restricted VLAN when multi-device port authentication
fails, enter commands such as the following.
BigIron RX(config)# interface e 3/1
BigIron RX(config-if-e100-3/1)# mac-authentication auth-fail-action restrict-vlan
100
Syntax: [no] mac-authentication auth-fail-action restrict-vlan [<vlan-id>]
If the ID for the restricted VLAN is not specified at the interface level, the global restricted VLAN ID
applies for the interface.
BigIron RX Series Configuration Guide
53-1001810-01
Username (1) – RFC 2865
FilterId (11) – RFC 2865
Vendor-Specific Attributes (26) – RFC 2865
Tunnel-Type (64) – RFC 2868
Tunnel-Medium-Type (65) – RFC 2868
EAP Message (79) – RFC 2579
Tunnel-Private-Group-Id (81) – RFC 2868
Drop traffic from the MAC address in hardware (the default)
Move the port on which the traffic was received to a restricted VLAN
Configuring multi-device port authentication
31
931