Mac Authentication, Dynamic VLANs and Silent Devices

[Erik_Auerswald]

Hi,

if dynamic VLAN assignment is used together with MAC authentication, so called silent devices pose a problem.

A silent device in this context is any end system that does not regularly send data. This results in both the MAC address and authentication session timing out sooner or later. Because the device's VLAN was assigned dynamically, with the end of the authentication session the VLAN is removed from the port. Thus the device is no longer reachable, because no frame, not even the ARP broadcast (or ND multicast) searching for the device's MAC will reach the device.

Common examples are printers, card readers, or even small 4 port switches installed in cable channels. Devices that are switched off but react to wake-on-LAN (WoL) packets fall into this categorie, too.

I know of two common strategies to handle those devices:

1. Add the device's VLAN as untagged to the port's VLAN egress list
2. Regularly contact the device so that neither MAC nor authentication time out

Method number one works fine on EOS devices, but is not available on all EXOS devices. At least some BroadCom FASTPATH based devices support this as well, but I haven't checked the Extreme 200 series yet.

EXOS devices with OnePolicy support can use a policy to add untagged VLANs to the egress list of the port (this works on EOS as well).

A variant of the first method can be used with EXOS for wake-on-LAN devices, by using a UDP profile that moves WoL packets to a VLAN configured statically on the port (see e.g. How to Allow Wake on LAN Magic Packets to be forwarded across vlans in EXOS). This works for UDP packets only, not for ARP or ND and thus cannot be used as a general silent device solution.

The second method can be implemented with EXOS switches, if the ARP timer is set low enough to expire before MAC and authentication session expire, and using ARP refresh (on by default).

Another method is to add the device to some monitoring software. Ping monitoring with a high enough frequency (not less than once inside the MAC and authentication timeout periods) suffices. This can be done with Extreme Management Center (EMC licensing depends on the number of monitored device). Open-Source software (e.g. Nagios or Icinga) can be used as well.

I have seen all of the above strategies used with success. Can anyone add additional methods to the list?

Thanks,
Erik

[Bin]

Kindly add the explanation about mac-lockdown timeout

https://documentation.extremenetworks.com/exos_commands_22.4/exos_21_1/exos_commands_all/r_enable-ma...

[Stephane_Grosj1]

other ways that I use:

- netlogin port restart: when a mac ages out, automatically trigger a disable/enable of the port to make it speak again. I have seen some green printers considering a quick flap like that is not worth going out of economy/sleep mode. Otherwise, it does the job.

- mac-lockdown timeout: allows you to set the age time per port. That way, I set it slightly above the DHCP lease timer, so I'm sure at least DHCP will generate enough traffic to keep it up. Of course, if the port goes down, mac is removed immediately.

configure mac-lockdown-timeout ports [all | port_list] aging-time seconds
enable mac-lockdown-timeout ports [all | port_list]

- scripting, of course: UPM could trigger a script with that EMS event "nl.ClientAgeOut" to do whatever is needed on that port. Not working with netlogin port restart.

[Erik_Auerswald]

Thanks for sharing that information! 🙂

[M_Nees]

On EXOS G1 Switches (non policy enabled switches) i use this:

configure netlogin ports [port_list | all] allow egress-traffic [none | unicast | broadcast | all_cast]

so although the session maybe timed-out the packet that should trigger re-auth was delivered. The or one vlan must configured manually on such ports.