https://community.extremenetworks.com/t5/faqs/i-g-c-b-a-series-f-w-6-61-08-0013-firstarrival-maclocking-can/m-p/42186#M95 Article ID: 14980 <BR /> <BR /> <B>Products</B><BR /> I-Series, firmware 6.42.09.0005 through 6.61.08.0013<BR /> G-Series, firmware 6.42.09.0005 through 6.61.08.0013<BR /> C5-Series; firmware 6.42.09.0005 through 6.61.08.0013, 6.71.01.0067 through 6.71.02.0008<BR /> C3-Series, firmware 6.42.09.0005 through 6.61.08.0013<BR /> B5-Series; firmware 6.42.09.0005 through 6.61.08.0013, 6.71.01.0067 through 6.71.02.0008<BR /> B3-Series, firmware 6.42.09.0005 through 6.61.08.0013<BR /> A4-Series; firmware 6.61.02.0007 through 6.61.08.0013, 6.71.01.0067 through 6.71.02.0008 <BR /> <BR /> <B>Changes</B><BR /> Set up one or more ports for MAC Locking of the first MAC seen ("maclock firstarrival 1"), EAPOL for assumed authentication ("eapol auth-mode forced-auth"), and single-user pass-or-fail authentication ("multiauth mode strict")(<A href="http://bit.ly/1qD0tGH" target="_blank" rel="nofollow noreferrer noopener">10283</A>). <BR /> <BR /> For example: <BR /> #eapol<BR /> set dot1x enable<BR /> set eapol enable<BR /> set eapol auth-mode forced-auth ge.1.1<BR /> !<BR /> <BR /> #maclock<BR /> set maclock enable<BR /> set maclock firstarrival ge.1.1 1<BR /> set maclock enable ge.1.1<BR /> !<BR /> <BR /> #multiauth<BR /> set multiauth mode strict<BR /> !<BR /> <B>Symptoms</B><BR /> Maclocked clients never connect to the network.<BR /> While a client is trying to connect, error message "Maca system disabled" is syslogged ('show support'); for example:<BR /> &lt;167&gt;Feb 6 15:09:25 10.26.1.92-1 MACA[121516080]: maca_api.c(289) 539 %<BR /> Maca system disabled<B>Solution/Workaround</B><BR /> Upgrade to 6.61 firmware 6.61.09.0012 or higher. <BR /> <A href="https://extranet.enterasys.com/downloads/" target="_blank" rel="nofollow noreferrer noopener">Release notes</A> state, in the 'Changes and Enhancements in 6.61.09.0012' section:<BR /> <DIV class="threadCode"><B>code:</B><PRE spellcheck="false">18194</PRE></DIV> <DIV class="threadCode"><B>code:</B><PRE spellcheck="false">Corrected the inability to access the network from a port in "force-auth" state, with multiauth mode set to strict, and maclocking firstarrival set to 1.</PRE></DIV><BR /> <BR /> Also fixed as of C5/B5/A4-Series firmware 6.71.03.0025 (though not stated in release notes).<BR /> <BR /> Pre-upgrade workaround: Change multiauth from strict mode to multi mode (<A href="http://bit.ly/18oGBhD" target="_blank" rel="nofollow noreferrer noopener">12499</A>), or enable maclock static and set maclock firstarrival 2 or greater. Thu, 05 Dec 2013 01:35:00 GMT FAQ_User 2013-12-05T01:35:00Z https://community.extremenetworks.com/t5/faqs/i-g-c-b-a-series-f-w-6-61-08-0013-firstarrival-maclocking-can/m-p/42186#M95 Article ID: 14980 <BR /> <BR /> <B>Products</B><BR /> I-Series, firmware 6.42.09.0005 through 6.61.08.0013<BR /> G-Series, firmware 6.42.09.0005 through 6.61.08.0013<BR /> C5-Series; firmware 6.42.09.0005 through 6.61.08.0013, 6.71.01.0067 through 6.71.02.0008<BR /> C3-Series, firmware 6.42.09.0005 through 6.61.08.0013<BR /> B5-Series; firmware 6.42.09.0005 through 6.61.08.0013, 6.71.01.0067 through 6.71.02.0008<BR /> B3-Series, firmware 6.42.09.0005 through 6.61.08.0013<BR /> A4-Series; firmware 6.61.02.0007 through 6.61.08.0013, 6.71.01.0067 through 6.71.02.0008 <BR /> <BR /> <B>Changes</B><BR /> Set up one or more ports for MAC Locking of the first MAC seen ("maclock firstarrival 1"), EAPOL for assumed authentication ("eapol auth-mode forced-auth"), and single-user pass-or-fail authentication ("multiauth mode strict")(<A href="http://bit.ly/1qD0tGH" target="_blank" rel="nofollow noreferrer noopener">10283</A>). <BR /> <BR /> For example: <BR /> #eapol<BR /> set dot1x enable<BR /> set eapol enable<BR /> set eapol auth-mode forced-auth ge.1.1<BR /> !<BR /> <BR /> #maclock<BR /> set maclock enable<BR /> set maclock firstarrival ge.1.1 1<BR /> set maclock enable ge.1.1<BR /> !<BR /> <BR /> #multiauth<BR /> set multiauth mode strict<BR /> !<BR /> <B>Symptoms</B><BR /> Maclocked clients never connect to the network.<BR /> While a client is trying to connect, error message "Maca system disabled" is syslogged ('show support'); for example:<BR /> &lt;167&gt;Feb 6 15:09:25 10.26.1.92-1 MACA[121516080]: maca_api.c(289) 539 %<BR /> Maca system disabled<B>Solution/Workaround</B><BR /> Upgrade to 6.61 firmware 6.61.09.0012 or higher. <BR /> <A href="https://extranet.enterasys.com/downloads/" target="_blank" rel="nofollow noreferrer noopener">Release notes</A> state, in the 'Changes and Enhancements in 6.61.09.0012' section:<BR /> <DIV class="threadCode"><B>code:</B><PRE spellcheck="false">18194</PRE></DIV> <DIV class="threadCode"><B>code:</B><PRE spellcheck="false">Corrected the inability to access the network from a port in "force-auth" state, with multiauth mode set to strict, and maclocking firstarrival set to 1.</PRE></DIV><BR /> <BR /> Also fixed as of C5/B5/A4-Series firmware 6.71.03.0025 (though not stated in release notes).<BR /> <BR /> Pre-upgrade workaround: Change multiauth from strict mode to multi mode (<A href="http://bit.ly/18oGBhD" target="_blank" rel="nofollow noreferrer noopener">12499</A>), or enable maclock static and set maclock firstarrival 2 or greater. Thu, 05 Dec 2013 01:35:00 GMT https://community.extremenetworks.com/t5/faqs/i-g-c-b-a-series-f-w-6-61-08-0013-firstarrival-maclocking-can/m-p/42186#M95 FAQ_User 2013-12-05T01:35:00Z