4

I'd like to know how to assign someone's client device to a different VLAN based on MAC address of that device.What kind of hardware/software would make this solution possible (if possible at all)? Would it be possbible to achieve the same using RADIUS authorization credentials instead of MAC addresses?

The reason why I'm asking this is because I'd like to migrate my company's internal network structure to something divided into separate subnets, isolating specific departments from each other, and providing separated, intranet isolated, guest accessible internet access. Would the method above be a right solution for this?

Improve this question
5
  • 1
    Have you considered 802.1x? What kind of switches do you have?
    – Mike Pennington
    Oct 30, 2013 at 7:07
  • 1
    Yes, I have. Our network is built around one server acting as a gateway (running virtualized IPFire, but we're making progress towards replacing it with a Netasq UTM 250) and everything behind that is (unluckily) simple network hardware like TP-Link wireless APs and some cheap, dumb switches from Dlink. What I'd like to end up with is a solution where a client computer tries to connect to the network, gets authenticated via 802.1x, RADIUS, or plain MAC and is then assigned to a VLAN of my choice. So that it can be either separated from, or provided with access to our intranet. Sound doable?
    – pietrek
    Oct 30, 2013 at 7:42
  • 1
    Specific product recommendations are going to be off-topic. Is it okay if we give you the most secure way of implementing the service?
    – Mike Pennington
    Oct 30, 2013 at 12:37
  • Sure. I'm just looking for suggestions, or examples of working solutions.
    – pietrek
    Oct 31, 2013 at 8:23
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 8, 2017 at 15:28

1 Answer 1

Reset to default
2

I am on the 1st phase of implementing a similar solution. 802.1x it's been for a while now and although it's grown up and globally supported it's vulnerable when meeting local OS network stack. I have deployed it several times on small and medium networks and usually it works for 90% of the workstations, maybe 95%. There is always an old Windows install that simply turns off your day.

Based on that I am working with FreeRadius. It requires broader knowledge except basic networking, but it doesn't interact in any way with the workstations, it's transparent for the user.

You can also try FreeNAC which is similar still it's been discontinued for some time now.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.