Currently we have a medium-sized, flat network with some DHCP pools. This configuration isn't satisfying us anymore, as everyone can see everything on the network and it may leads to security issues. Our plan is to segment the existing network into Layer2 sub-networks at a organizational level (HR, dev, network services, etc.). We have a very heterogeneous infrastructure with mainly Linux but also Windows, some Macs, IP phones, network printers, VMs, Dockers, etc.
We want to avoid static/port-based VLAN and go for a solution as dynamic as possible. A MAC based VLAN assignment is desired as we already have a MAC addresses list. A big requirement is also no (or minimal) user-side configuration. This mainly to reduce user support and troubles.
For now we would go for a solution based on 802.1x. Our plan is to have a RADIUS server (FreeRADIUS) doing the MAC authentication and VLAN assignment. But on one side it collides with our no-user-config desire as the supplicant must be configured (at least activating 802.1x on endpoints). We also thought about using MAC access list on our managed switches which is, for us, less flexible and harder to maintain.
It seems that no one on the internet have set up a 802.1x MAC-based auth and I wanted to gather implementations ideas on this. Have you ever set up a MAC-based authentication ? With 802.1x ? Is 802.1x good for MAC-based auth ? What was your deployment plan ? What difficulties have you encountered ? Do you know any other MAC-based host authentication method ?
I know it's a lot of questions but I'm looking for cases, ideas and ways to implement such a solution; I'm not asking for a ready-to-go one.
Kind regards
Note: We are aware that MAC-based authentication is not the best secured way to authenticate hosts. However, using 802.1x and RADIUS allows us to easily change the authentication method if needed one day