topic C9200L with mult-auth and multi-domain in Network Access Control

C9200L with mult-auth and multi-domain

kakada Atada — Fri, 01 Mar 2024 05:03:34 GMT

Dear Community

What are the benefit and disadvantage configuration from multi-auth to multi-domain?

Note: one port for 1 device only

There have endpoints connecting on switch like MAB profiling ( ATM, CCTV, printer, IP phone ) and PC.

Thanks,

Re: C9200L with mult-auth and multi-domain

Arne Bier — Fri, 01 Mar 2024 05:46:09 GMT

Multi-domain is the strictest config form you can have, when you have a requirement to allow only 1 MAC address in data domain and 1 MAC address in voice Domain. Data domain is the access VLAN, and voice domain is the voice VLAN.

Multi-auth on the other hand, allows more than one MAC address in the data domain. And 1 MAC address in the Voice domain.

I find multi-domain can backfire on you, when you have phones that don't play ball, and if their MAC addresses land up in the data domain AND there is an active PC (or whatever) attached to the phone, then you violate the 1 MAC address limit. That shuts the port with an err-disable.

Re: C9200L with mult-auth and multi-domain

kakada Atada — Fri, 01 Mar 2024 06:08:25 GMT

Thanks for your update @Arne Bier