Brocade Communications Systems 6650 manual Disabling the aging of MAC addresses on interfaces

Multi-device port authentication configuration

The denied-onlyparameter prevents denied sessions from being aged out, but ages out permitted sessions.

The permitted-onlyparameter prevents permitted (authenticated and restricted) sessions from being aged out and ages denied sessions.

Disabling the aging of MAC addresses on interfaces

To disable aging for all MAC addresses subject to authentication on a specific interface where multi-device port authentication has been enabled, enter the command at the interface level.

Example

Brocade(config)# interface ethernet 1/3/1 Brocade(config-if-e10000-1/3/1)# mac-authentication disable-aging

Syntax: [no] mac-authentication disable-aging

Changing the hardware aging period for blocked

MAC addresses

When the Brocade device is configured to drop traffic from non-authenticated MAC addresses, traffic from the blocked MAC addresses is dropped in hardware, without being sent to the CPU. A Layer 2 hardware entry is created that drops traffic from the MAC address in hardware. If no traffic is received from the MAC address for a certain amount of time, this Layer 2 hardware entry is aged out. If traffic is subsequently received from the MAC address, then an attempt can be made to authenticate the MAC address again.

Aging of the Layer 2 hardware entry for a blocked MAC address occurs in two phases, known as hardware aging and software aging.

On Brocade ICX 6650 devices, the hardware aging period for blocked MAC addresses is fixed at 70 seconds and is non-configurable. (The hardware aging time for non-blocked MAC addresses is the length of time specified with the mac-agecommand.) The software aging period for blocked MAC addresses is configurable through the CLI, with the mac-authenticationmax-agecommand. After the hardware aging period ends, the software aging period begins. When the software aging period ends, the blocked MAC address ages out, and can be authenticated again if the Brocade device receives traffic from the MAC address.

To change the hardware aging period for blocked MAC addresses, enter a command such as the following.

Brocade(config)# mac-authentication hw-deny-age 10

Syntax: [no] mac-authentication hw-deny-age num

The num parameter is a value from 1 to 65535 seconds. The default is 70 seconds.

Brocade ICX 6650 Security Configuration Guide	249
53-1002601-01