`Auth`

Port-based network access control

Shortest form: a.

Port-based network access control (802.1X-style port authorisation). A port is in one of three states. Uncontrolled: all traffic passes. Unauthorised: traffic is blocked in both directions, or on ingress only. Authorised: traffic passes, optionally with L2 learning or ignoring link state. Type sub-command words in full; abbreviations are not accepted. Arguments are Key=<value> pairs. Without arguments the command prints the usage. 交换芯片Helix4 L2 L3功能验证 shows the commands in use on a Helix4 switch.

On some devices the command only prints auth: command unsupported on <device> and does nothing. Trident 3 is not one of them: auth show works, and on a SONiC switch every port is in the uncontrolled state, since SONiC does not use this feature.

show is read-only. Every other sub-command changes port-security state in the switch behind syncd.

Warning

block and disable stop all traffic on the selected ports, and detach removes the module. On a SONiC switch this cuts off data-plane and control traffic on those ports.

Auth show

For each front-panel port, in port-number order, print one of port in uncontrolled state., port is unauthorized for <all|ingress> direction(s)., port is authorized. or port is authorized with condition(s) L2LEARN IGNORE_LINK IGNORE_VIOLATION (only the conditions that apply).

Hardware-validated

drivshell> auth show
port ce0 in uncontrolled state.
port ce1 in uncontrolled state.
port xe0 in uncontrolled state.
port xe1 in uncontrolled state.
port xe2 in uncontrolled state.
port xe3 in uncontrolled state.
port ce2 in uncontrolled state.
port ce3 in uncontrolled state.
port ce4 in uncontrolled state.
port ce5 in uncontrolled state.
port ce6 in uncontrolled state.
port ce7 in uncontrolled state.
port ce8 in uncontrolled state.
port ce9 in uncontrolled state.
port ce10 in uncontrolled state.
port ce11 in uncontrolled state.
port ce12 in uncontrolled state.
port ce13 in uncontrolled state.
port ce14 in uncontrolled state.
port xe4 in uncontrolled state.
port ce15 in uncontrolled state.
port ce16 in uncontrolled state.
port ce17 in uncontrolled state.
port ce18 in uncontrolled state.
port ce19 in uncontrolled state.
port ce20 in uncontrolled state.
port ce21 in uncontrolled state.
port ce22 in uncontrolled state.
port ce23 in uncontrolled state.
port ce24 in uncontrolled state.
port ce25 in uncontrolled state.
port ce26 in uncontrolled state.
port ce27 in uncontrolled state.
port ce28 in uncontrolled state.
port ce29 in uncontrolled state.
port ce30 in uncontrolled state.

Auth init

Initialise the auth module. An error prints auth: error initializing: <error>.

Unvalidated

drivshell> auth init

Auth detach

Remove the auth module.

Unvalidated

drivshell> auth detach

Auth mac init

Install the switch MAC address from the station_mac_address config property on all ports. Without the property the shell prints station_mac_address not set. On success it prints All ports set to MAC address <mac>.

Unvalidated

drivshell> auth mac init

Auth mac add [PortBitMap=<pbmp>] [Mac=<mac>]

Add a switch MAC address on each port in the bitmap. Auth mac del takes the same arguments and removes one address.

The built-in help shows the key as MACaddress. The shell accepts Mac, so MACaddress=… fails.

Unvalidated

drivshell> auth mac add PortBitMap=xe0 Mac=00:11:22:33:44:55

Auth mac clear [PortBitMap=<pbmp>]

Remove all switch MAC addresses from the ports.

Unvalidated

drivshell> auth mac clear PortBitMap=xe0

Auth block [PortBitMap=<pbmp>] [IngressOnly=<bool>]

Make the ports unauthorised, blocking both directions or only ingress. Prints port blocked in <all|ingress> direction(s)..

Unvalidated

drivshell> auth block PortBitMap=xe0 IngressOnly=true

Auth unblock [PortBitMap=<pbmp>]

Return the ports to the uncontrolled state, in which all traffic is allowed. Prints port unblock - all traffic allowed now..

Unvalidated

drivshell> auth unblock pbm=xe3

Auth enable [PortBitMap=<pbmp>] [LearnEnable=<bool>] [IgnorLink=<bool>]

Authorise the ports, optionally with L2 learning and ignoring link state. Prints port authorization enabled.. Auth disable [PortBitMap=<pbmp>] blocks the ports again and prints port authorization disable - no traffic allowed..

Unvalidated

drivshell> auth enable pbm=xe3 LE=false IL=false

Built-in help

Usages:
    auth init
           - Init auth function
    auth detach
           - Detach auth function
    auth mac init
           - Add switch mac address from config to all ports
    auth mac add  [PortBitMap = <pbmp>] [MACaddress=<address>]
           - Add switch mac address
    auth mac del  [PortBitMap = <pbmp>] [MACaddress=<address>]
           - Delete switch mac address
    auth mac clear  [PortBitMap = <pbmp>]
           - Clear all switch mac addresses
    auth block [PortBitMap = <pbmp>] [IngressOnly=true|false]
           - Block traffic for all directions or ingress direction only
    auth unblock [PortBitMap = <pbmp>]
           - All traffic allowed, ports in uncontrolled state
    auth enable [PortBitMap = <pbmp>] [LearnEnable=true|false]
                [IgnorLink=true|false]
           - Authorized ports to allow traffic
    auth disable [PortBitMap = <pbmp>]
           - Put ports back in block state
    auth show
           - Show ports access state

Auth

`Auth`