922 BigIron RX Series Configuration Guide53-1001986-01Configuring multi-device port authentication31BigIron RX(config)# interface e 3/1BigIron RX(config-if-e100-3/1)# mac-authentication auth-fail-action block-trafficSyntax: [no] mac-authentication auth-fail-action block-trafficDropping traffic from non-authenticated MAC addresses is the default behavior when multi-deviceport authentication is enabled.Defining MAC address filtersYou can specify MAC addresses that do not have to go through multi-device port authentication.These MAC addresses are considered pre-authenticated, and are not subject to RADIUSauthentication. To do this, you can define MAC address filters that specify the MAC addresses toexclude from multi-device port authentication.You should use a MAC address filter when the RADIUS server itself is connected to an interfacewhere multi-device port authentication is enabled. If a MAC address filter is not defined for theMAC address of the RADIUS server and applied on the interface, the RADIUS authenticationprocess would fail since the device would drop all packets from the RADIUS server itself.For example, the following command defines a MAC address filter for address 0010.dc58.aca4.BigIron RX(config)# mac-authentication mac-filter 1 permit 0010.dc58.aca4Syntax: [no] mac-authentication mac-filter The following commands apply the MAC address filter on an interface so that address0010.dc58.aca4 is excluded from multi-device port authentication.BigIron RX(config)# interface e 3/1BigIron RX(config-if-e100-3/1)# mac-authentication apply-mac-auth-filter 1Syntax: [no] mac-authentication apply-mac-auth-filter Configuring dynamic VLAN assignmentAn interface can be dynamically assigned to a VLAN based on the MAC address learned on thatinterface. When a MAC address is successfully authenticated, the RADIUS server sends the devicea RADIUS Access-Accept message that allows the device to forward traffic from that MAC address.The RADIUS Access-Accept message can also contain attributes set for the MAC address in itsaccess profile on the RADIUS server.If one of the attributes in the Access-Accept message specifies a VLAN identifier, and this VLAN isavailable on the device, the port is moved from its default VLAN to the specified VLAN.To enable dynamic VLAN assignment for authenticated MAC addresses, you must add the followingattributes to the profile for the MAC address on the RADIUS server (dynamic VLAN assignment onmulti-device port authentication-enabled interfaces is enabled by default and can be disabled).Refer to “Dynamic VLAN and ACL assignments” on page 918 for a list of the attributes that must beset on the RADIUS serverDynamic VLAN assignment on a multi-device port authentication-enabled interface is enabled bydefault. If it is disabled, enter commands such as the following command to enable it.BigIron RX(config)# interface e 3/1BigIron RX(config-if-e100-3/1)# mac-authentication enable-dynamic-vlanSyntax: [no] mac-authentication enable-dynamic-vlan
