1

I want to implement a Network Access Control ( NAC ) infrastructure in my LAN. My topology is something like:

PC -> ( Untagged Port - PVID 100 - Non 802.1x capable smart switch ) -> ( Hybrid port - 802.1x Dynamic VLAN capable managed switch ) -> PacketFence

So, PCs and other devices aren´t connected directly to the 802.1x Dynamic VLAN capable switch ( HP 1920G ) but to a smart switch ( TP-Link TL-1016DE ). This switch tag frames coming into the untagged port with VLAN ID 100 and send them tagged to the 1920.

My question is: a tagged frame could be subject of 802.1x authentication and dynamic VLAN assigment by the 1920? or that just work for untagged frames?

Thanks in advance

Manuel

Improve this question
1
  • 1
    You trust on trunk ports between switches. The 802.1X frames are link-only frames that should not get beyond the first switch. In all likelihood, having a switch between the hosts and the 802.1X port will prevent 802.1X from functioning.
    – Ron Maupin ♦
    Oct 18, 2016 at 20:01

1 Answer 1

Reset to default
0

Unfortunately, 802.1X uses link-local frames. An 802.1D compliant bridge (switch) does not forward these types of frames (multicast OUI 01:80:C2). You should not be able to do 802.1X authentication across an intervening bridge or switch, so what you propose should not be possible.

Basically, you need to run 802.1X on the access ports of the access switch. Switches should be configured to trust on switch-to-switch links.

Improve this answer
3
  • You are right about that a switch doesn´t forward 802.1x frames.
    – Manuel Lapeyre
    Oct 19, 2016 at 16:55
  • Just for your information, I found that Linux kernel 3.2+ bridge allows that: gremwell.com/linux_kernel_can_forward_802_1x
    – Manuel Lapeyre
    Oct 19, 2016 at 16:57
  • That is another way in which Linux isn't open standards compliant when it comes to networking.
    – Ron Maupin ♦
    Oct 19, 2016 at 18:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.