Mac Move; Mac Replace - Cisco Catalyst 2960 Software Configuration Manual

Chapter 10 Configuring IEEE 802.1x Port-Based Authentication
•
•
•
•
•
•

MAC Move

When a MAC address is authenticated on one switch port, that address is not allowed on another
authentication manager-enabled port of the switch. If the switch detects that same MAC address on
another authentication manager-enabled port, the address is not allowed.
There are situations where a MAC address might need to move from one port to another on the same
switch. For example, when there is another device (for example a hub or an IP phone) between an
authenticated host and a switch port, you might want to disconnect the host from the device and connect
it directly to another port on the same switch.
You can globally enable MAC move so the device is reauthenticated on the new port. When a host moves
to a second port, the session on the first port is deleted, and the host is reauthenticated on the new port.
MAC move is supported on all host modes. (The authenticated host can move to any port on the switch,
no matter which host mode is enabled on the that port.)
When a MAC address moves from one port to another, the switch terminates the authenticated session
on the original port and initiates a new authentication sequence on the new port.
The MAC move feature applies to both voice and data hosts.
In open authentication mode, a MAC address is immediately moved from the original port to the new
Note
port, with no requirement for authorization on the new port.
For more information see the

MAC Replace

To configure the MAC replace feature, the switch must be running the LAN base image.
Note
Beginning with Cisco IOS Release 12.2(55)SE, the MAC replace feature can be configured to address
the violation that occurs when a host attempts to connect to a port where another host was previously
authenticated.
OL-26520-01
A host is authorized on the port with no VLAN assignment, and subsequent hosts either have no
VLAN assignment, or their VLAN information matches the operational VLAN.
The first host authorized on the port has a group VLAN assignment, and subsequent hosts either
have no VLAN assignment, or their group VLAN matches the group VLAN on the port. Subsequent
hosts must use the same VLAN from the VLAN group as the first host. If a VLAN list is used, all
hosts are subject to the conditions specified in the VLAN list.
Only one voice VLAN assignment is supported on a multi-auth port.
After a VLAN is assigned to a host on the port, subsequent hosts must have matching VLAN
information or be denied access to the port.
You cannot configure a guest VLAN or an auth-fail VLAN in multi-auth mode.
The behavior of the critical-auth VLAN is not changed for multi-auth mode. When a host tries to
authenticate and the server is not reachable, all authorized hosts are reinitialized in the configured
VLAN.
"Enabling MAC Move" section on page 10-51.
Catalyst 2960 and 2960-S Switches Software Configuration Guide, Release 15.0(1)SE
Understanding IEEE 802.1x Port-Based Authentication
10-15