802.1x Multiple Devices

Question

I'm in the process of implementing wired 802.1x. I've been testing with HP 2530 switches and everything seems to work okay enough. On a different site I use Brocade (now Ruckus) 6450 switches. I can enable 802.1x and devices can authenticate.

The HP switches appeared to authenticate for the port on the switch, but the brocade switches seem to authenticate the mac address. The difference being that if I attach another switch to the HP switch then multiple devices or mac addresses can have their traffic pass on the single port. On the brocade device any new mac addresses are expected to authenticate. But because the second switch I have added is doing the authentication the clients connected to this switch end up being blocked.

I can't test it right at this minute with a wireless access point but my testing suggests that whilst my access point can authenticate, the clients connected to the access point cannot. I also have a number of Axis network video encoders (P7216 https://www.axis.com/en-gb/products/axis-p7216) which while only having a single network port utilise four MAC and IP Addresses. Again I imagine only one of the MAC addresses would authenticate.

Does anyone have any experience of this? I think it should be a feature I can disable (or have only enabled inadvertently.) But I'm not sure what it might be called. I can see how authenticating multiple devices on a single port could be useful but in the cases I have given this isn't so.

Thanks

EDIT:
Currently for testing purposes I am using a HP/Aruba 2530-8 switch as my supplicant. I will actually be using Arbuba AP-315 wireless access points and the axis device I mentioned. This is because the Authenticator switch I have on site doesn't support POE and the Axis encoders are in production.

On the site that I work we use HP/Aruba 2530-48g-poe+ switchs as access switches. When I connect the 2530-8 to the 2530-48-poe+ switch the radius server returns the vlan configuration in the usual manner and the port on the authenticator is configured as specified. Clients that plug into the 2530-8 switch don't need to authenticate against the 2530-8 switch and they can access the network through the port that has been enabled on the 2530-48-poe+ switch. This is what I want to happen.

On another site we use Brocade 6450 switches. When the same 2530-8 switch plugs in to the brocade switch the 2530-8 switch is enable and I can ping the management interface of the supplicant switch. However clients that are connected to the 2530-8 are blocked by the brocade switch that acts as the authenticator because it sees the mac addresses of the clients and deems them to not have authenticated. I do not want this.

I believe in Aruba/HP these two scenarios are port mode 802.1x and user mode 802.1x. But I'm not sure this translates to other manufacturers. Brocade has documentation on using multiple users that are authenticated on a single port but the implementation doesn't work how I want. Effectively the client is still required to authenticate against the brocade switch but this is in turn blocked by the 2530-8 switch as it is handling the authentication.

Answer 1

802.1X is a port authentication protocol that is designed for edge ports - single link, single client, single MAC address.

You use 802.1X when there's no better way to secure port access. Better and possibly more secure methods include securing physical access - keeping the cabinet or closet locked at all times.

As a side note, 802.1X is not fool-proof by design (at all...). Only few implementations are really hard to fool - often a simple repeater hub with an authenticating client does the trick. If you need "perfect" security you'll require MACsec.

802.1X doesn't make sense when there are multiple MAC addresses one a port. While multiple MACs do work with several implementations, they don't with others (which is actually slightly better than plain 802.1X).

Generally, you don't use 802.1X between switches, other bridging devices, or towards routers or hosts - there are better options, see above.

Summing up, you'd use 802.1X only on your edge switches and there only on the edge ports, not on the uplinks.