Let's say I have an office where each RJ45 jack needs to support 4 computers. Each of those RJ45 jacks is connected to one port on a 24 port managed switch in the networking closet. However, we also need to use 5 port switches between the wall jack and the 4 computers.
Which of the following options is the best way to implement 802.1x?
- Option A)
Buy a 24 port managed switch with 802.1x support. Find some managed 5 port switches, where they can both authenticate to the parent switch, as well as authenticating their own ports with clients. I don't know if this kind of 802.1x daisy-chaining is possible, so please let me know. But this way, no-one could plug in a hub between the wall jack and the 5 port switch to get unauthenticated access to the network.
- Option B)
Buy a managed, 48 port switch, and lock it in the networking closet. Re-wire the office so that we have groups of 4 wall jacks instead of 1, and remove the intermediate 5 port switches. This way, each port will be authenticated with 802.1x, and someone would have to break into the networking closet to gain access to the internal network.
- Option C)
Keep the 24 port unmanaged switch that we're currently using in the network closet, but buy managed 5 port switches that support 802.1x. Remove the wall jacks and plug the cables directly into the managed switches, plug each of the computers into the switches, and then lock the switches inside tamper-proof boxes. This way, no-one can easily gain access to the unauthenticated ethernet connection, at least without cutting into network cables.
In each of these cases we will have ARP spoofing protection, and will shut down the port if it detects suspicious activity.
Please let me know which option you think is best, or if you can think of an even better solution. We've just rolled out 802.1x for wifi, but our current network topology makes wired 802.1x quite difficult to implement.