Brocade ICX 6650 Security Configuration Guide 163
53-1002601-01
802.1X port security configuration

802.1X accounting

When 802.1X port security is enabled on the Brocade device, you can enable 802.1X accounting.
This feature enables the Brocade device to log information on the RADIUS server about
authenticated 802.1X clients. The information logged on the RADIUS server includes the 802.1X
client session ID, MAC address, and authenticating physical port number.
802.1X accounting works as follows.
1. A RADIUS server successfully authenticates an 802.1X client.
2. If 802.1X accounting is enabled, the Brocade device sends an 802.1X Accounting Start packet
to the RADIUS server, indicating the start of a new session.
3. The RADIUS server acknowledges the Accounting Start packet.
4. The RADIUS server records information about the client.
5. When the session is concluded, the Brocade device sends an Accounting Stop packet to the
RADIUS server, indicating the end of the session.
6. The RADIUS server acknowledges the Accounting Stop packet.
To enable 802.1X accounting, refer to “802.1X accounting configuration” on page182.
802.1X port security configuration
Configuring 802.1X port security on a Brocade device consists of the following tasks.
1. Configure the device interaction with the Authentication Server:
•“Configuring an authentication method list for 802.1X” on page164
•“Setting RADIUS parameters” on page164
•“Dynamic VLAN assignment for 802.1X port configuration” on page166 (optional)
•“Dynamically applying IP ACLs and MAC address filters to 802.1X ports” on page170
2. Configure the device role as the Authenticator:
•“Enabling 802.1X port security” on page174
•“Initializing 802.1X on a port” on page178 (optional)
3. Configure the device interaction with Clients:
•“Configuring periodic re-authentication” on page175 (optional)
•“Re-authenticating a port manually” on page 176 (optional)
•“Setting the quiet period” on page176 (optional)
•“Setting the wait interval for EAP frame retransmissions” on page176 (optional)
•“Setting the maximum number of EAP frame retransmissions” on page 177 (optional)
•“Specifying a timeout for retransmission of messages to the authentication server” on
page178 (optional)
•“Allowing access to multiple hosts” on page179 (optional)
•“MAC address filters for EAP frames” on page182 (optional)