Filter
Top Products
1244 PowerConnect B-Series FCX Configuration Guide
53-1002266-01
Configuring 802.1X port security
34
• Permitted dot1x-mac-sessions, which are the dot1x-mac-sessions for authenticated Clients, as
well as for non-authenticated Clients whose ports have been placed in the restricted VLAN, are
aged out if no traffic is received from the Client MAC address over the normal MAC aging
interval on the Dell PowerConnect device.
• Denied dot1x-mac-sessions, which are the dot1x-mac-sessions for non-authenticated Clients
that are blocked by the Dell PowerConnect device are aged out over a configurable software
aging period. (Refer to the next section for more information on configuring the software aging
period).
You can optionally disable aging of the permitted or denied dot1x-mac-sessions, or both, on the
Dell PowerConnect device.
To disable aging of the permitted dot1x-mac-sessions, enter the following command.
PowerConnect(config-dot1x)#mac-session-aging no-aging permitted-mac-only
Syntax: [no] mac-session-aging no-aging permitted-mac-only
To disable aging of the denied dot1x-mac-sessions, enter the following command.
PowerConnect(config-dot1x)#mac-session-aging no-aging denied-mac-only
Syntax: [no] mac-session-aging no-aging denied-mac-only
NOTE
This command enables aging of permitted sessions.
As a shortcut, use the command [no] mac-session-aging to enable or disable aging for permitted
and denied sessions.
Specifying the aging time for blocked clients
When the Dell PowerConnect device is configured to drop traffic from non-authenticated Clients,
traffic from the blocked Clients is dropped in hardware, without being sent to the CPU. A Layer 2
CAM entry is created that drops traffic from the blocked Client MAC address in hardware. If no
traffic is received from the blocked Client MAC address for a certain amount of time, this Layer 2
CAM entry is aged out. If traffic is subsequently received from the Client MAC address, then an
attempt can be made to authenticate the Client again.
Aging of the Layer 2 CAM entry for a blocked Client MAC address occurs in two phases, known as
hardware aging and software aging. The hardware aging period is fixed at 70 seconds and is
non-configurable. The software aging time is configurable through the CLI.
Once the Dell PowerConnect device stops receiving traffic from a blocked Client MAC address, the
hardware aging begins and lasts for a fixed period of time. After the hardware aging period ends,
the software aging period begins. The software aging period lasts for a configurable amount of
time (by default 120 seconds). After the software aging period ends, the blocked Client MAC
address ages out, and can be authenticated again if the Dell PowerConnect device receives traffic
from the Client MAC address.
Change the length of the software aging period for a blocked Client MAC address by entering a
command such as the following.
PowerConnect(config)#mac-session-aging max-age 180
Syntax: [no] mac-session-aging max-age <seconds>
You can specify from 1 – 65535 seconds. The default is 120 seconds.