0

I am considering using a RADUIS for MAC authentication. But the concern I have is that in my network each host has two links going to two switches (SW-A, SW-B) the link going to (SW-B) is a "Stand-by" link. And since the these links going to both switches are having the same MAC will that cause a problem with the RADUIS server when using MAC authentication?

Thanks.

Improve this question

1 Answer 1

Reset to default
3

Before we get to the radius part, a comment about this:

And since the these links going to both switches are having the same MAC

Be sure to understand how your host handles MAC addresses when failing over from one NIC & Switchport to the other, to avoid MAC-Flapping between the switches. The various host side NIC redundancy features may have different strategies for that (but host side questions are off-topic for this board).

Switch aspect:

The issue might be less with the RADIUS server as such, but more with the switches and their concept of "MAC based authentication session" and what comes with it. For example: once a MAC is learned on a port and authenticated (for example with 802.1X with MACAuthenticationBypass, "MAB" for short), some switches generate a static entry in their CAM table, and they will refuse to dynamically learn that MAC address on any other port, as long as the given authentication session is valid and active.

If you like, please let us know vendor, model and software version of your switches, and some configuration extracts you've been working on for MAC based authentication. We might be able to explore the switch aspect a bit deeper.

RADIUS aspect:

Usually, a 802.1X/MAB enabled switch will just ask (overly simplified) "Hey RADIUS, I have this MAC address here as a username on switchport x/xx. What do you want me to do with it?", upon which the RADIUS server's response might be be some "access-accept", possibly with a few attributes such as a VLAN ID, or it might be a negative answer. This is as far as the RADIUS protocol goes.

However, the RADIUS server's backend (database, application logic, etc.) might also have the notion of a "session" and a policy that might allow or forbid to authenticate the same user or MAC address from a different switch&port while there already is an existing session... and now we're again leaving the scope of this board.

Improve this answer
3
  • 1
    Good answer. I would chime in to suggest that a better solution might be to implement LACP with the Switch A and Switch B implementing MEC/MLAG/vPC/vPC+/EvPC, etc. No more need for a MAC address to move as it will always stay on the 'port channel' or LAG interface as long as either switch is available and a link is up.
    – FrameHowitzer
    May 23 at 18:12
  • You are right of course: running a variety of of multi chassis link aggregation is the gold standard to have both link redundancy and possibly get some load distribution benefits for servers. Then again, Cisco switches don't support 802.1X on EtherChannels/Port-Channels...
    – Marc 'netztier' Luethi
    May 23 at 19:04
  • I completely forgot that. You're right! Makes sense, why would you want to enable port security on a server that should remain connected all the time and should be in a secured physical environment. In fact, the use of port security on a redundant link design seems irrational. Port security (MAC based at least) is a bit antithetical to link redundancy and reliability, uncommon for use with end user devices for sure.
    – FrameHowitzer
    May 23 at 19:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.