Brocade ICX 6650 Security Configuration Guide 181
53-1002601-01
802.1X port security configuration
As a shortcut, use the command [no] mac-session-aging to enable or disable aging for permitted
and denied sessions.
Specifying the aging time for blocked clients
When the Brocade device is configured to drop traffic from non-authenticated Clients, traffic from
the blocked Clients is dropped in hardware, without being sent to the CPU. A Layer 2 CAM entry is
created that drops traffic from the blocked Client MAC address in hardware. If no traffic is received
from the blocked Client MAC address for a certain amount of time, this Layer 2 CAM entry is aged
out. If traffic is subsequently received from the Client MAC address, then an attempt can be made
to authenticate the Client again.
Aging of the Layer 2 CAM entry for a blocked Client MAC address occurs in two phases, known as
hardware aging and software aging. The hardware aging period is fixed at 70 seconds and is
non-configurable. The software aging time is configurable through the CLI.
Once the Brocade device stops receiving traffic from a blocked Client MAC address, the hardware
aging begins and lasts for a fixed period of time. After the hardware aging period ends, the software
aging period begins. The software aging period lasts for a configurable amount of time (by default
120 seconds). After the software aging period ends, the blocked Client MAC address ages out, and
can be authenticated again if the Brocade device receives traffic from the Client MAC address.
Change the length of the software aging period for a blocked Client MAC address by entering the
mac-age-time num command.
Brocade(config)# mac-age-time 180
Syntax: [no] mac-age-time seconds
You can specify from 1–65535 seconds. The default is 120 seconds.
Moving native VLAN mac-sesions to restrict VLAN
You can move the native VLAN mac-sessions to restrict VLAN on authentication failure. You can
configure the option of overriding the dual-mode port native untagged VLAN with re stricted VLAN in
case 802.1x authentication fails and there is no RADIUS assigned VLAN. Use this command when
you configure multi-device port authentication and 802.1X authentication configuration with
dynamic VLAN assignment from RADIUS Server on the same port.
Example
Brocade(config-dot1x)# auth-fail-force-restrict
[no] auth-fail-force-restrict
Clearing a dot1x-mac-session for a MAC address
You can clear the dot1x-mac-session for a specified MAC address, so that the Client with that MAC
address can be re-authenticated by the RADIUS server.
Example
Brocade# clear dot1x mac-session 0000.0034.abd4
Syntax: clear dot1x mac-session mac-address