Specifying To Which Vlan A Port Is Moved After Its Radius-Specified Vlan Assignment Expires - Dell PowerConnect B-RX Configuration Manual

Enabling dynamic VLAN support for tagged packets on non-member VLAN ports
By default, the Brocade device drops tagged packets that are received on non-member VLAN ports.
This process is called ingress filtering. Since the MAC address of the packets are not learned,
authentication does not take place.
The Brocade device can authenticate clients that send tagged packets on non-member VLAN
ports.This enables the Brocade device to add the VLAN dynamically. To enable support, enter the
following command at the Interface level of the CLI.
BigIron RX(config)# interface e 3/1
BigIron RX(config-if-e100-3/1)# mac-authentication disable-ingress-filtering
If the client MAC address is successfully authenticated and the correct VLAN attribute is sent by the
RADIUS server, the MAC address will be successfully authenticated on the VLAN.
Syntax: [no] mac-authentication disable-ingress-filtering
Configuration notes and limitations:
•
•
•
Specifying to which VLAN a port is moved after its
RADIUS-specified VLAN assignment expires
When a port is dynamically assigned to a VLAN through the authentication of a MAC address, and
the MAC session for that address is deleted on the device, then by default the port is removed from
its RADIUS-assigned VLAN and placed back in the VLAN where it was originally assigned.
A port can be removed from its RADIUS-assigned VLAN when any of the following occur:
•
•
•
For example, say port 1/1 is currently in VLAN 100, to which it was assigned when MAC address
0007.eaa1.e90f was authenticated by a RADIUS server. The port was originally configured to be in
VLAN 111. If the MAC session for address 0007.eaa1.e90f is deleted, then port 1/1 is moved from
VLAN 100 back into VLAN 111.
You can optionally specify an alternate VLAN to which to move the port when the MAC session for
the address is deleted. For example, to place the port in the restricted VLAN, enter commands such
as the following.
BigIron RX(config)# interface e 3/1
BigIron RX(config-if-e100-3/1)# mac-auth move-back-to-old-vlan port-restrict-vlan
Syntax: [no] mac-authentication move-back-to-old-vlan disable | port-configured-vlan |
The disable keyword disables moving the port back to its original VLAN. The port would stay in its
RADIUS-assigned VLAN.
BigIron RX Series Configuration Guide
53-1002253-01
This feature works in conjunction with multi-device port authentication with dynamic VLAN
assignment only.
The port on which ingress filtering is disabled must be tagged to a VLAN.
If a host sends both tagged and untagged traffic, and ingress filtering is disabled on the port,
the port must be configured as a dual-mode port.
The link goes down for the port
The MAC session is manually deleted with the mac-authentication clear-mac-session
command
The MAC address that caused the port to be dynamically assigned to a VLAN ages out
port-restrict-vlan | system-default-vlan
Configuring multi-device port authentication
31
933