Mac Authentication Bypass - Dell S6100 Configuration Manual

Critical VLAN:
Critical VLAN id:
Mac-Auth-Bypass:
Mac-Auth-Bypass Only:
Static-MAB:
Static-MAB Profile:
Tx Period:
Quiet Period:
ReAuth Max:
Supplicant Timeout:
Server Timeout:
Re-Auth Interval:
Max-EAP-Req:
Host Mode:
Max-Supplicants:
Port status and State info for Supplicant: 7a:d9:d9:7d:00:00
Port Auth Status:
Untagged VLAN id:
Auth PAE State:
Backend State:
Port status and State info for Supplicant: 7a:d9:d9:7d:00:01
Port Auth Status:
Untagged VLAN id:
Auth PAE State:
Backend State:
Restricting Multi-Supplicant Authentication
To restrict the number of devices that 802.1X can authenticate on a port in multi-supplicant (multi-auth) mode, enter the dot1x max-
supplicants number command in Interface mode. By default, the maximum number of multi-supplicant devices is 128.
Dell(conf-if-te-2/1)# dot1x max-supplicants 4

MAC Authentication Bypass

MAC authentication bypass (MAB) enables you to provide MAC-based security by allowing only known MAC addresses within the network
using a RADIUS server.
802.1X-enabled clients can authenticate themselves using the 802.1X protocol. Other devices that do not use 802.1X — like IP phones,
printers, and IP fax machines — still need connectivity to the network. The guest VLAN provides one way to access the network.
However, placing trusted devices on the quarantined VLAN is not the best practice. MAB allows devices that have known static MAC
addresses to be authenticated using their MAC address, and places them into a VLAN different from the VLAN in which unknown devices
are placed.
For an 802.1X-incapable device, 802.1X times out if the device does not respond to the Request Identity frame. If MAB is enabled, the port
is then put into learning state and waits indefinitely until the device sends a packet. Once its MAC is learned, it is sent for authentication to
the RADIUS server (as both the username and password, in hexadecimal format without any colons). If the server authenticates
successfully, the port is dynamically assigned to a MAB VLAN using a RADIUS attribute 81, or is assigned to the untagged VLAN of the
port. Afterward, packets from any other MAC address are dropped. If authentication fails, the authenticator waits the quiet-period and then
restarts the authentication process.
MAC authentication bypass works in conjunction and in competition with the guest VLAN and authentication-fail VLAN. When both
features are enabled:
1 If authentication fails, the port it is placed into the authentication-fail VLAN.
2 If the host does not respond to the Request Identity frame, the port transitions to MAB initiation state.
Disable
NONE
Disable
Disable
Disable
NONE
30 seconds
60 seconds
2
30 seconds
30 seconds
3600 seconds
2
MULTI_AUTH
128
AUTHORIZED
400
Authenticated
Idle
AUTHORIZED
400
Authenticated
Idle
802.1X 99