Keepalive for MAC Authentication Clients

Keepalive can be enabled for all MAC-authenticated users at the global level. By enabling keepalive, the administrator can prevent the MAC-authenticated session from aging out when no traffic is being sent from the client.

This feature provides a way to identify connections from devices that are not regularly sending data. The ICX devices can be configured to send periodic ARP requests to keep these devices active. If the device is up and responds to the ARP request, the session will stay active. If the device stops responding to the ARP request, the session will be cleared automatically.

Note: The keepalive feature is available for IPv4 MAC-authenticated clients.
In order to support keepalive, the switch MAC-Authentication session needs to be updated with the client's IPv4 address, and the client should be reachable using that IP address. For IPv6 clients, the ICX device sends ND discovery by default, and silent MAC-authenticated devices will be learned by IPv6 ND. When the MAC address is removed from the MAC table, an ARP request is automatically sent. To ensure that the device sends at least one ARP request to all client devices, set the max-sw-age command to a minimum of 120 seconds and a multiple of 30 seconds.

Keep-aliveness for clients is directly proposed to max-sw-age command. For example, if max-sw-age is 120 seconds, then a maximum 120 clients shall be considerable for keep-aliveness.

You can enable keepalive for MAC authentication clients using the mac-authentication keep-alive command.

device# configure terminal
device(config)# authentication
device(config-authen)# mac-authentication keep-alive

When the MAC authentication keepalive is configured on the ICX device, it is displayed in the output of the show running-config authentication command.

device# show running-config authentication
Current configuration for flexauth:
  authentication
  auth-default-vlan 12
  max-sw-age 180
  mac-authentication enable
  mac-authentication enable ethe 1/1/3
  mac-authentication password-format xxxx.xxxx.xxxx
  mac-authentication keep-alive
Parent topic: MAC Authentication