mac based vlan , multiple edge switches .

  • 0
  • 1
  • Question
  • Updated 2 years ago
  • Answered
  • (Edited)
Configuration of mac based netlogin , when vlan spread over a number of switches.

I am trying to limit the mac addresses that access a number of switches on the same vlan , from reading the Guides I understand the concept .. just putting this into practice is the issue ( still have to lab ) 

Basically my thoughts are " as this is a port based thing , each switch with this specific vlan will need to be configured for netlogin ( using local list on each switch with the vlan) , not including the uplinks .. each switch with this netlogin vlan will need a copy of the mac addresses being allowed connection .

I'm also going to configure the vlan ports for "limit Learning 1" 

I would like to configure the limit learning or the lock learning , so that there is no time out value.

Basically for reason of security we want to control  very tightly , who has access to the switch, and therefore our networks. 
Photo of Rod Robertson

Rod Robertson

  • 2,344 Points 2k badge 2x thumb

Posted 2 years ago

  • 0
  • 1
Photo of Ryan Mathews

Ryan Mathews, Alum

  • 8,988 Points 5k badge 2x thumb
Bumping back to the top for Rod.
Photo of Karthik Mohandoss

Karthik Mohandoss, Employee

  • 5,998 Points 5k badge 2x thumb
Hi Rod,

I am not sure if i got your requirement correctly. 

Limit learning is port and VLAN combination command, so i do not think you can use both Netlogin and limit-learning on the same port. 

Once netlogin is enabled for a port it would automatically placed in to the netlogin vlan where the Client PC would have no access to the network only after successful authentication it would be placed in to a VLAN which is returned by the Radius.

This article might help you with the Netlogin complete config.

https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-configure-Mac-based-Netlogin-with-R...
Photo of Henrique

Henrique, Employee

  • 10,302 Points 10k badge 2x thumb
Hi Rod,

Limit-learning is dynamic and it will limit the number of MAC addresses that can be learned in a vlan and port.

Lock-learning causes all dynamic FDB entries associated with the specified VLAN and ports to be converted to locked static entries. It also sets the learning limit to 0, so that no new entries can be learned. All new source MAC addresses are blackholed.

Those features don't need Netlogin to be enabled.

If you want to just control the number of mac per port (without authentication), limit-learning will help. However, if you want to lock an specific MAC (again, without authentication), then you can use lock-learning, but that MAC must be already in the FDB.

Do you want to use MAC-based authentication or just control the MAC learned in each switch/vlan/port?