N/S-Series MAC Authentication Failures will not Retry with Default Quietperiod

  • 0
  • 1
  • Article
  • Updated 4 years ago
  • (Edited)
Article ID: 12933 

Matrix N-Series DFE

Enabled MAC Authentication ('set macauthentication...', 'set radius...', 'set multiauth...').
Users on one or more ports have failed authentication, for any reason.

Authentication continues to fail for those users (= MACs), unless the failure is cleared from the port.

Failed authentications (rejects received from the RADIUS server) are treated differently than other types of failures (timeouts, resource issues, etc.). The macauthentication quiet period is the key here and is set to 0 by default. 0 indicates "wait forever regardless of the port state transitions". If you set the quiet period to some other value you will see the same MAC that previously failed try to auth again after that period.

Functions as Designed (FAD).

In operational networks, the quiet period is normally left at its default value. This is because machine-type authentications rarely fail, and when they do, there is usually a good reason - such as an unauthorized user attempting to gain network access.

However, manipulation of this parameter can be helpful during MAC Authentication testing and deployment, to help speed up that process.

To attempt reauthentication on a port, after some period of time:
set macauthentication quietperiod <seconds> <port#>

To clear a prior failure that has already occurred on the same port while quietperiod=0:
clear multiauth station port <port#>

See also: 7664.
Photo of FAQ User

FAQ User, Official Rep

  • 13,620 Points 10k badge 2x thumb

Posted 4 years ago

  • 0
  • 1

There are no replies.

This conversation is no longer open for comments or replies.