10-16
Catalyst 2960 and 2960-S Switch Software Configuration Guide
OL-8603-09
Chapter 10 Configuring IEEE 802.1x Port-Based Authentication
Understanding IEEE 802.1x Port-Based Authentication
MAC Move
When a MAC address is authenticated on one switch port, that address is not allowed on another
authentication manager-enabled port of the switch. If the switch detects that same MAC address on
another authentication manager-enabled port, the address is not allowed.
There are situations where a MAC address might need to move from one port to another o n the same
switch. For example, when there is another device (for example a hub or an IP phone) between an
authenticated host and a switch port, you might want to disconnect the host from the device and connect
it directly to another port on the same switch.
You can globally enable MAC move so the device is reauthenticated on the new port. When a host moves
to a second port, the session on the first port is deleted, and the host is reauthenticated on the new port.
MAC move is supported on all host modes. (The authenticated host can move to any port on the switch,
no matter which host mode is enabled on the that port.)
Beginning with Cisco IOS Release 12.2(55)SE, MAC move can be configured in all host modes, along
with port security.
Note To configure MAC move with port security, the switch must be running the LAN base image.
When a MAC address moves from one port to another, the switch terminates the authenticated session
on the original port and initiates a new authentication sequence on the new port. Port security behavior
remains the same when you configure MAC move.
The MAC move feature applies to both voice and data hosts.
Note In open authentication mode, a MAC address is immediately moved from the original port to the new
port, with no requirement for authorization on the new port.
For more information see the “Enabling MAC Move” section on page 10-52.
MAC Replace
Note To configure the MAC replace feature, the switch must be running the LAN base image.
Beginning with Cisco IOS Release 12.2(55)SE, the MAC replace feature can b e configured to address
the violation that occurs when a host attempts to connect to a port where another host was previously
authenticated.
Note This feature does not apply to ports in multi-auth mode, because violations are not triggered in that
mode. It does not apply to ports in multiple host mode, because in that mode, only the first host requires
authentication.
If you configure the authentication violation interface configuration command with the replace
keyword, the authentication process on a port in multi-domain m ode is:
• A new MAC address is received on a port with an existing authen ticated MAC address.