Configuring Mac Move - Cisco Catalyst 4500 series Administration Manual

Chapter 46 Configuring 802.1X Port-Based Authentication
Dot1x Authenticator Client List Empty
Port Status
Switch#

Configuring MAC Move

MAC move allows an authenticated host to move from one switch port to another.
You should remove port security before configuring MAC move.
Note
To globally enable MAC move on the switch, perform this task:
Command
Step 1
Switch# configure terminal
Step 2
Switch(config)# authentication
mac-move permit
Step 3
Switch(config-if)# end
Step 4
Switch# show run
Step 5
Switch # copy running-config
startup-config
This example shows how to globally enable MAC move on a switch:
Switch# configure terminal
Switch(config)# authentication mac-move permit
The following syslog messages displays when MAC-move happens:
%AUTHMGR-5-SECUREMACMOVE: <mac-addr> moved from <interface-name> to <interface-name>
Configuring MAC Replace
MAC replace allows new users to connect to abandoned ports.
If a user disconnects but the switch has not received the EAPoL-Logoff, the session will remain up. For
single or multiple- domain modes, no new hosts can connect to that port. If a new host tries to connect,
a violation is triggered on the port. Where the violation action is configured as replace, the desired
behavior is for the NAD (switch) to terminate the initial session and reset the authentication sequence
based on the new MAC.
To enable MAC replace on a switch, perform this task:
Command
Step 1
Switch# configure terminal
Step 2
Switch(config)# interface
interface-id
OL_28731-01
= AUTHORIZED
Purpose
Enters global configuration mode.
Enable MAC move globally.
Returns to privileged EXEC mode.
Verifies your entries.
(Optional) Saves your entries in the configuration file.
Purpose
Enters global configuration mode.
Enters interface configuration mode.
Software Configuration Guide—Release IOS XE 3.6.0E and IOS 15.2(2)E
Configuring 802.1X Port-Based Authentication
46-57