Brocade Communications Systems 6650 manual Port e1/1/1 Dual Mode

Example port authentication configurations

Example 1— Multi-device port authentication with dynamic VLAN assignment

Figure 11 illustrates multi-device port authentication with dynamic VLAN assignment on a Brocade device. In this configuration, a PC and an IP phone are connected to a hub, which is connected to port e1/1/1 on a Brocade device. Port e1 is configured as a dual-mode port. Also, mac-authenticationdisable-ingress-filteringis enabled on the port. The profile for the PC MAC address on the RADIUS server specifies that the PC should be dynamically assigned to VLAN 102, and the RADIUS profile for the IP phone specifies that it should be dynamically assigned to VLAN 3.

FIGURE 11 Using multi-device port authentication with dynamic VLAN assignment

RADIUS Server

Tunnel-Private-Group-ID:

User 0000.007f.2e0a -> “U:102”

User 0000.008e.86ac -> “T:3”

Brocade Switch

Port e1/1/1

Dual Mode

Hub

UntaggedTagged

PC	IP Phone
MAC: 0000.007f.2e0a	MAC: 0000.008e.86ac

In this example, multi-device port authentication is performed for both devices. If the PC is successfully authenticated, dual-mode port e1 PVID is changed from the VLAN 1 (the DEFAULT-VLAN) to VLAN 102. If authentication for the PC fails, then the PC can be placed in a specified “restricted” VLAN, or traffic from the PC can be blocked in hardware. In this example, if authentication for the PC fails, the PC would be placed in VLAN 1023, the restricted VLAN.

If authentication for the IP phone is successful, then dual-mode port e1/1/1 is added to VLAN 3. If authentication for the IP phone fails, then traffic from the IP phone would be blocked in hardware. (Devices sending tagged traffic cannot be placed in the restricted VLAN.)

NOTE

This example assumes that the IP phone initially transmits untagged packets (for example, CDP or DHCP packets), which trigger the authentication process on the Brocade device and client lookup on the RADIUS server. If the phone sends only tagged packets and the port (e1/1/1) is not a member of that VLAN, authentication would not occur. In this case, port e1 must be added to that VLAN prior to authentication.

The part of the running-config related to multi-device port authentication would be as follows.

262	Brocade ICX 6650 Security Configuration Guide
	53-1002601-01