1

I want to be able to remotely access an Ethernet switch-port protected by 802.1x. The switch I want to access is at a distant site, but I have a T1 circuit that goes from that site to my office. I tried using a set up like the picture shows, where I used two Ethernet to T1 bridges, but the problem I'm having is that the EAPOL frames seem to be addressed to 01:80:c2:00:00:03, which is filtered by the bridges and not passed to the host/laptop. These bridges are non configurable, and I can't change the config on the switch so I have to find another workaround. What I basically need is a solution makes the T1 bridge "look like a cable" to the host and switch. first solution, that didn't work.

Reading around, I've read mention of a transparent bridge, whereby one may use two cisco routers with T1 interfaces as a bridge, and the Ethernet ports can be made to ignore LLDP, which would make it pass the frames addressed for 01:80:c2:00:00:03. Would a solution like the one described in the picture work for my purposes? Also can anyone tell me how I would need to configure the routers to pass all frames addressed to 01:80:xx:xx:xx:xx?
proposed soultion. Thanks

Improve this question
2
  • First, a switch is a bridge. Next, 802.1X is on the link between the host and the switch (bridge). If you want 802.1X protection, you need it on the bridge to which the host is connected. You can't connect via 802.1X three switches over.
    – Ron Maupin ♦
    Commented Sep 21, 2015 at 3:43
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 6, 2017 at 19:23

2 Answers 2

Reset to default
0

Cisco routers and switches can certainly ignore LLDP, but neither will they pass LLDP frames on. LLDP is a link protocol, meaning is won't go beyond the link on which it was originated.

There are many such link-only protocols that are never passed beyond the link on which they originate.

The only way to make something like this work is with devices that are simply layer-1 devices like media converters or hubs, not layer-2 (or above) devices like bridges or switches.

Improve this answer
2
  • I thought the devices I was using were basically media converters. Black box calls it a "1-Port T1/E1 Ethernet Network Extender Kit", which I thought would be invisible to the link layer. I need something that would appear as just a plain old cable to the 3 layer switch and the host. So from what you're telling me, I should be able to accomplish what I want to do with proper Ethernet to T1 media converters?
    – Frank
    Commented Sep 21, 2015 at 4:43
  • You need something that doesn't operate at layer-2. There may be such a device. The other option is to put a switch on your end to which you connect 802.1X, but you would need to disable it at the switch on the other end.
    – Ron Maupin ♦
    Commented Sep 21, 2015 at 4:51
1

If your T1-Link and devices are just bridges, either they must authenticate to the local switch-port

or bridge all traffic so that both switches are dot.x client to each other .

Having ethernet-frames with odd first-byte 01:, 03: , ... the are all multicast or broadcast. They may get lost due to the fact that "intelligent" Bridges also want to reduce all the broadcast traffic. Also, Traffic with special desination MAC Adresses are "link-local" and should never be bridged further but go to the local switch'S CPU to be processed. There may be an configuration option to forward everything, this depends on your device.

You may also use a pair of (for just T1 ancient) Cisco-Devices (1841 with appropiatio T1 module); configure a private ip subnet on the T1 link, and configure a l2tpv3 xconnect between physical port

( and if that does not work, that cisco device may dot1x authentificate to the switch, at least with username/password )

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.