Brocade Communications Systems 6650 manual Enabling source guard protection

Multi-device port authentication configuration

To limit the susceptibility of the Brocade device to such attacks, you can configure the device to use multiple RADIUS servers, which can share the load when there are a large number of MAC addresses that need to be authenticated. The Brocade device can run a maximum of 10 RADIUS clients per server and will attempt to authenticate with a new RADIUS server if current one times out.

In addition, you can configure the Brocade device to limit the rate of authentication attempts sent to the RADIUS server. When the multi-device port authentication feature is enabled, it keeps track of the number of RADIUS authentication attempts made per second. When you also enable the DoS protection feature, if the number of RADIUS authentication attempts for MAC addresses learned on an interface per second exceeds a configurable rate (by default 512 authentication attempts per second), the device considers this a possible DoS attack and disables the port. You must then manually re-enable the port.

The DoS protection feature is disabled by default. To enable it on an interface, enter commands such as the following.

Brocade(config)# interface ethernet 1/3/1 Brocade(config-if-e10000-1/3/1)# mac-authentication dos-protection enable

ITo specify a maximum rate for RADIUS authentication attempts, enter commands such as the following.

Brocade(config)# interface ethernet 1/3/1 Brocade(config-if-e10000-1/3/1)# mac-authentication dos-protection mac-limit 256

Syntax: [no] mac-authentication dos-protection mac-limit number

You can specify a rate from 1–65535 authentication attempts per second. The default is a rate of 512 authentication attempts per second.

Enabling source guard protection

Source Guard Protection is a form of IP Source Guard used in conjunction with multi-device port authentication. When Source Guard Protection is enabled, IP traffic is blocked until the system learns the IP address. Once the IP address is validated, traffic with that source address is permitted.

NOTE

Source Guard Protection is supported together with multi-device port authentication as long as ACL-per-port-per-vlanis enabled.

When a new MAC session begins on a port that has Source Guard Protection enabled, the session will either apply a dynamically created Source Guard ACL entry, or it will use the dynamic IP ACL assigned by the RADIUS server. If a dynamic IP ACL is not assigned, the session will use the Source Guard ACL entry. The Source Guard ACL entry is permit ip secure-ipany, where secure-ipis obtained from the ARP Inspection table or from the DHCP Secure table. The DHCP Secure table is comprised of DHCP Snooping and Static ARP Inspection entries.

The Source Guard ACL permit entry is added to the hardware table after all of the following events occur:

•The MAC address is authenticated

•The IP address is learned

246	Brocade ICX 6650 Security Configuration Guide
	53-1002601-01