1

We have a selection of Unifi, Meraki and Arista switches. We're currently trying to sort out our 802.1x/RADIUS infrastructure

It seems like Meraki has the best 802.1x support (e.g. supporting multi-auth, supporting MAC-address bypass etc.) - is it possible to have the Meraki switches upstream, and then have the other switches downstream pass on the EAP frames seamlessly? Are there any caveats we should be aware of?

I should disable 802.1x on all other downstreams ports and leave them open?

Improve this question
4
  • 1
    I don't think you understand how 802.1X actually works. It is configured on the switch interface to which a host connects.
    – Ron Maupin ♦
    Aug 5, 2018 at 12:49
  • Any 802.1D compliant switch will not forward EAP frames. They are link-local scope only. You are thinking about EAP like DHCP -- something one can relay.
    – Ricky
    Aug 5, 2018 at 22:42
  • Aha - got it - yes, I did see a mention somewhere about STP and forwarding EAP frames. Drat, you're right, I was misunderstanding that part. The main reason was - the Meraki switch has much better 802.1x support (e.g. multi-auth, MAC-address bypass etc.) - but the downstream switches closer to devices do not. So you're saying we'd need to patch devices in directly to the Meraki to actually use it's 802.1x auth, or get new downstream switches.
    – victorhooi
    Aug 5, 2018 at 22:51
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Dec 25, 2018 at 9:14

2 Answers 2

Reset to default
3

802.1X EAP frames are supposed to only be used between the client (supplicant) and its uplink switch (authenticator). The authenticator then uses a higher layer protocol for communication with the authentication server. The higher layer protocol can be switched and routed as desired.

You cannot use 802.1X authentication across several switches. Essentially, this would only authenticate the downlink port on the authenticating switch - this inherently authenticates all ports further downstream.

Additionally, you shouldn't use 802.1X between switches. Use the edge switch to authenticate edge ports and trust your interlink ports.

Improve this answer
3
  • This applies even with Cisco/Meraki multi-auth, right? (Which handles authentication multiple devices plugged into a single port).
    – victorhooi
    Aug 5, 2018 at 22:51
  • Also why do you not recommend 802.1x for the interlink ports? What is the alternative?
    – victorhooi
    Aug 5, 2018 at 23:45
  • You shouldn't require port authentication on interlink ports. Most switches don't support being a 802.1X client anyway. The interlinks should be protected within locked rooms or cabinets.
    – Zac67 ♦
    Aug 6, 2018 at 6:15
1

Assuming you are trying to use 802.1x to allow or prevent communication by a client through a given switch port (i.e. Port Access Control as defined in the 802.1x standard) the scenario you describe doesn't work. The standard explicitly states that : "The operation of Port-based Access Control assumes that the Ports on which it operates offer a point-to-point connection between a single Supplicant and a single Authenticator", which is not the case if you try to use an upstream switch to deal with the access negotiation.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.