246 Brocade ICX 6650 Security Configuration Guide
53-1002601-01
Multi-device port authentication configuration
To limit the susceptibility of the Brocade device to such attacks, you can configure the device to use
multiple RADIUS servers, which can share the load when there are a large number of MAC
addresses that need to be authenticated. The Brocade device can run a maximum of 10 RADIUS
clients per server and will attempt to authenticate with a new RADIUS server if current one times
out.
In addition, you can configure the Brocade device to limit the rate of authentication attempts sent
to the RADIUS server. When the multi-device port authentication feature is enabled, it keeps track
of the number of RADIUS authentication attempts made per second. When you also enable the
DoS protection feature, if the number of RADIUS authentication attempts for MAC addresses
learned on an interface per second exceeds a configurable rate (by default 512 authentication
attempts per second), the device considers this a possible DoS attack and disables the port. You
must then manually re-enable the port.
The DoS protection feature is disabled by default. To enable it on an interface, enter commands
such as the following.
Brocade(config)# interface ethernet 1/3/1
Brocade(config-if-e10000-1/3/1)# mac-authentication dos-protection enable
ITo specify a maximum rate for RADIUS authentication attempts, enter commands such as the
following.
Brocade(config)# interface ethernet 1/3/1
Brocade(config-if-e10000-1/3/1)# mac-authentication dos-protection mac-limit 256
Syntax: [no] mac-authentication dos-protection mac-limit number
You can specify a rate from 1–65535 authentication attempts per second. The default is a rate of
512 authentication attempts per second.
Enabling source guard protection
Source Guard Protection is a form of IP Source Guard used in conjunction with multi-device port
authentication. When Source Guard Protection is enabled, IP traffic is blocked until the system
learns the IP address. Once the IP address is validated, traffic with that source address is
permitted.
NOTE
Source Guard Protection is supported together with multi-device port authentication as long as
ACL-per-port-per-vlan is enabled.
When a new MAC session begins on a port that has Source Guard Protection enabled, the session
will either apply a dynamically created Source Guard ACL entry, or it will use the dynamic IP ACL
assigned by the RADIUS server. If a dynamic IP ACL is not assigned, the session will use the Source
Guard ACL entry. The Source Guard ACL entry is permit ip secure-ip any, where secure-ip is
obtained from the ARP Inspection table or from the DHCP Secure table. The DHCP Secure table is
comprised of DHCP Snooping and Static ARP Inspection entries.
The Source Guard ACL permit entry is added to the hardware table after all of the following events
occur:
•The MAC address is authenticated
•The IP address is learned