Why would someone use authentication mac-move permit when dot1x authentication is not performed by the switch?

Note that there are APs attached to the switch, which are being authenticated by a WLC.

  • perhaps so the switch(es) don't freak out when wireless clients roam between APs. – Ricky Dec 30 '13 at 21:17
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 10 '17 at 1:55

If there is no 802.1x, port-security or other network access control configurations on this switch, then either someone did not understand the purpose of this command, or it was left over from a previous configuration. I have often seen people replace/move/'borrow'/etc. switches in enterprise networks where they do not wipe out the old config and just apply the config from the switch that is being replaced. In those scenarios you end up with all sorts of extra configuration, like have a bunch of 'switchport trunk' config on a port that was changed to an access port.

Also depending on the configuration of the APs and the WLC, the underlying switch never sees any client traffic, as it is all being encapsulated back to the controller. So the only MAC addresses that the switch sees in that case are the MAC addresses of the APs and the WLC interface that they are tunneling the traffic to.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.