3

I have a closed network of 3 switches and 40 computers. 35 of those computers (Windows 7 x64 Professional) need to be plugged into any of the 24 ports on 2 of the switches at any time depending on the need and location of the user. I want to secure the switch to only allow these specific computers to connect. If another computer plugs in I want the switch to disable the port.

On previous small networks with no movement I configured each port with Port Security and the correct MAC Address of the computer. But for this I have more MACs than the Port Security table can handle. I was thinking about using 802.1X but I don't have a router on this system of which I am told I need for 802.1X. When I Google information for 802.1X configuration I end up with a lot of information on Wireless of which we don't use.

So my question is can I do 802.1X without a router and if so is there information on how to configure a server if needed? I have the switches setup with RADIUS authentication to access the SSH and console which works great.

Switches are HP ProCurve 2910al-24G.

Improve this question
2
  • 802.1x does not require a router. You need a RADIUS server that is connected to the management VLAN (it's a good idea to separate management traffic from user traffic in any case, but RADIUS pretty much assumes to run inside a separate network).
    – Simon Richter
    Commented Oct 29, 2018 at 16:31
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Commented Dec 25, 2018 at 9:54

1 Answer 1

Reset to default
5

The 2910al supports 802.1X port security as authenticator, using RADIUS over EAP or PEAP. Depending on your exact goals, an additional router is not required but you do need a RADIUS server. Check the 2910's "Access and Security Guide" chapter 13. If you've got nothing local to use as a RADIUS server you'll need a router to connect elsewhere - however, you can also set up something like a Raspberry Pi for RADIUS.

MAC authentication is also possible in combination with RADIUS, see chapter 3. The 2910 can also use standalone Local MAC Authentication (LMA, chapter 4). I haven't done that yet and the manual doesn't list any table size restrictions, so you might need to give it a try.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.