4

I'd like to know how to assign someone's client device to a different VLAN based on MAC address of that device.What kind of hardware/software would make this solution possible (if possible at all)? Would it be possbible to achieve the same using RADIUS authorization credentials instead of MAC addresses?

The reason why I'm asking this is because I'd like to migrate my company's internal network structure to something divided into separate subnets, isolating specific departments from each other, and providing separated, intranet isolated, guest accessible internet access. Would the method above be a right solution for this?

  • 1
    Have you considered 802.1x? What kind of switches do you have? – Mike Pennington Oct 30 '13 at 7:07
  • 1
    Yes, I have. Our network is built around one server acting as a gateway (running virtualized IPFire, but we're making progress towards replacing it with a Netasq UTM 250) and everything behind that is (unluckily) simple network hardware like TP-Link wireless APs and some cheap, dumb switches from Dlink. What I'd like to end up with is a solution where a client computer tries to connect to the network, gets authenticated via 802.1x, RADIUS, or plain MAC and is then assigned to a VLAN of my choice. So that it can be either separated from, or provided with access to our intranet. Sound doable? – pietrek Oct 30 '13 at 7:42
  • 1
    Specific product recommendations are going to be off-topic. Is it okay if we give you the most secure way of implementing the service? – Mike Pennington Oct 30 '13 at 12:37
  • Sure. I'm just looking for suggestions, or examples of working solutions. – pietrek Oct 31 '13 at 8:23
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 8 '17 at 15:28
2

I am on the 1st phase of implementing a similar solution. 802.1x it's been for a while now and although it's grown up and globally supported it's vulnerable when meeting local OS network stack. I have deployed it several times on small and medium networks and usually it works for 90% of the workstations, maybe 95%. There is always an old Windows install that simply turns off your day.

Based on that I am working with FreeRadius. It requires broader knowledge except basic networking, but it doesn't interact in any way with the workstations, it's transparent for the user.

You can also try FreeNAC which is similar still it's been discontinued for some time now.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.