we're migrating an automatically configured secure environment (where only per-port authorized MAC addresses may communicate) from using on-switch-configured MAC lists (managed via SNMP) to using 802.1x / RADIUS (with LDAP as config store) where possible. Currently I'm testing different scenarios to verify possible operational processes. I'm using a 6450 with AOS 6.6.4 for tests, but will have various other Alcatel switch models to handle as well.
Currently, when central processes decide that a MAC address is no longer permitted on a specific port, that MAC address is removed from the port configuration. If for some reason the system is still active, the port is immediately shut down by the switch.
With 802.1x/RADIUS, I have noticed that changes in the LDAP directory will not reflect to the switch, since the switch doesn't send re-authentication requests to the RADIUS server at all, despite having set "802.1x s/p ... re-authperiod 240 reauthentication". I guess this setting only affects supplicants? (We'll have to act much quicker than any re-auth timer, but need a fail-safe against failing SNMP requests.)
A potential work-around would be to issue "802.1x s/p port-control force-unauthorized" followed by "802.1x s/p port-control auto", but this will interrupt traffic for all stations using that switch port, not only that single MAC address. Is there a way to "reset" the authorization status of a single non-supplicant/MAC?
Originally we started walking this path because of switch limits when creating MAC-to-port security relationships, and overloading the switch by SNMP requests for configuration updates and state monitoring. But it seems that port mobility, although recommended by Alcatel staff, does have sufficient own limits and still depends on plenty of SNMP communications in our use case
Regards,
Jens
