Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

For questions about the 802.1X protocol for port-based network access control.

3
votes
2answers
42 views

Does 802.1Q protocol will remove the VLAN tag in the received place?

Does 802.1Q protocol will remove the VLAN tag in the received place? Such as the VLAN 10 trough 802.1Q protocol to pass frames. the 802.1Q will add 802.1q header(tag) and recalculate CRC/FCS like ...
1
vote
0answers
25 views

Network segmentation with VLAN and MAC auth: thoughts about implementation

Currently we have a medium-sized, flat network with some DHCP pools. This configuration isn't satisfying us anymore, as everyone can see everything on the network and it may leads to security issues. ...
0
votes
1answer
62 views

Cisco 2960-S switch with MAB and Packetfence Web Authentication

I am trying to set up Packetfence In my corporate environment for guest users, with MAC access bypass. i have done everything like in the official Packetfence installation guide https://packetfence....
6
votes
2answers
460 views

Mitigating 802.1x bypass by transparent bridging

The talk DEFCON talk "A Bridge Too Far" details a means to bypass wired 802.1x network access controls by setting up a transparent bridge between a genuine machine and the network. Once authentication ...
2
votes
1answer
64 views

Guest VLAN doesn't work at wired connection on HP 1920 JG927A

I'm tring to get properly working configuration on HP 1920 with dot1x and guest-vlan. All my authenticated computers works fine also auth-fail vlan is working properly. Any One has idea what can be a ...
3
votes
2answers
473 views

When doing 802.1X port authentication, how does the switch know how reach the authentication server?

So, while I get the supplicant-authenticator-authentication server structure (for the most part), the part that bugs me is the step when the switch starts communicating with the authentication server; ...
1
vote
1answer
457 views

802.1x and use Google G Suite Directory as LDAP

Has anyone managed to authenticate yours to the network via 802.1x using Google Directory? I have a case where whole company is using Google Apps and G-Suite with a custom domain and they would like ...
0
votes
0answers
18 views

Command to enable MAC-based 802.1x on Arista EOS?

The Arista EOS documentation mentions An account for the supplicant connected to an authenticator port and placed in the MAC address-based authentication mode needs use the MAC address of the node ...
0
votes
2answers
126 views

Will all switches pass 802.1x EAP seamlessly? Any caveats?

We have a selection of Unifi, Meraki and Arista switches. We're currently trying to sort out our 802.1x/RADIUS infrastructure It seems like Meraki has the best 802.1x support (e.g. supporting multi-...
0
votes
0answers
43 views

Multi-auth for 802.1x wired - Unifi, Meraki and Arista - preventing multiple devices or rogue switches per port?

We're trying to implement wired 802.1x to provide security for a wired LAN. We're planning to use use PacketFence as our RADIUS server. We have a mixture of Unifi, Arista and a Meraki switches. ...
3
votes
1answer
79 views

802.1X on wired networks

Suppose i'm protection physically accessible RJ45 sockets in offices that are connected to a switch (Cisco SF220) with 802.1X port based authentication and a radius server. Authorized devices have ...
1
vote
1answer
176 views

Dot1x re-authentication for computers connect via IP phone

I am currently working on dot1x solution for wired users. Configuration we have is working fine for most of our use cases, except one. We have working solution for users that are connected to the ...
2
votes
1answer
461 views

Can't use “dot1x” command in Cisco Packet Tracer

I am trying to configure 802.1X authentication on a Cisco switch 2960 in Cisco Packet Tracer software. Here I found the offical guide: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/...
5
votes
2answers
145 views

Juniper: WakeOnLan over 802.1x without using default VLAN

Case We have a working 802.1x configuration on all our access ports. I want to enable WakeOnLan, but have no idea, how to target computers with Magic Packet. Tests We tried to send Magic Packet ...
1
vote
1answer
46 views

What are connectivity associations in LAN? - IEEE Std 802.1X-2010

In IEEE Std 802.1X-2010, Appendix D, Section D.8, there is the following phrase However simple or complex, the establishment of a connectivity association for connectionless data transfer ...
0
votes
0answers
151 views

802.1X and OOBM (Out of Band Management)

I would like to know if it's possible to configure the oobm interface as a supplicant port for 802.1X usage. Context: We have to configure a network administration inside a big infrastructure. We ...
1
vote
1answer
269 views

Is PMKID same for a specific client when it is roaming from AP1 to AP2 using WPA2-Enterprise?

I have two access points (APs) setup with the same SSID name and using the same freeRADIUS server for station authentication. I have read Cisco documentation about fast roaming. So I have this doubt ...
3
votes
1answer
218 views

AAA & NAC: Use last authorized vlan of a port, if AAA-Server is dead?

I'd like to know if there is any way to configure the switch so, that in case the radius-server is dead and devices try to (re)-authenticate the port gets the latest vlan which was authorized on this ...
1
vote
1answer
68 views

In 802.11 Wi-Fi, Is it better to be on the same channel as other networks instead of being in an overlapping channel?

While being on the same channel as another network is not ideal is it better than being on a neighboring overlapping channel because 802.11 spec has methods for dealing with co-channel interference? ...
0
votes
1answer
95 views

VLAN management in 802.1X

I would like to learn how is VLAN management in 802.1X port based authentication. Are there something specific in 802.1X about VLANs? Because VLAN is also part of Layer 2.
3
votes
1answer
524 views

How does NAC or NAP enhance 802.1X?

I'm studying about 802.1X port based authentication and RADIUS, and I came across the terms of NAC (Network Admission Control) and NAP (Network Access Protection). As long as I know NAC tries to unify ...
1
vote
1answer
625 views

802.1x authentication and dynamic VLAN assignment of VLAN tagged frames

I want to implement a Network Access Control ( NAC ) infrastructure in my LAN. My topology is something like: PC -> ( Untagged Port - PVID 100 - Non 802.1x capable smart switch ) -> ( Hybrid port - ...
2
votes
2answers
17k views

What's the difference between RADIUS and 802.1X Port-Based Authentication?

As long as I know RADIUS is a type of authentication protocol, where for example if someone wants to use a switch, it first of all needs to enter his/her credentials, and properly authenticate himself/...
0
votes
1answer
251 views

Can you change your MAC and IP address on 802.1X port?

It's related to this question: Is 802.1x port security enforces IP uniqueness If you have 802.1X port security can you change a MAC address of your device (to some other unused MAC address)? Will it ...
2
votes
1answer
65 views

Is 802.1x port security enforces IP uniqueness

I know that 802.1x can track MAC addresses. If MAC address is used on one port then you can prohibit it from being used on another port. Can 802.11x protocol do the same thing for IP addresses? My ...
0
votes
1answer
334 views

VxLAN optional outer 802.1Q purpose?

So, I've been checking Google along with the RFC 7348 about VxLAN functionality. I believe I do have a good grasp of what the purpose of the protocol is, what it does and how it does it etc but I fail ...
0
votes
1answer
121 views

802.1X for Wi-FI

I have a hidden SSID network. I know that although the SSID is hidden, someone can sniff the Wi-Fi channels to get my SSID, and with that SSID he can use some OpenWRT-ish things to spoof my Wi-Fi ...
5
votes
1answer
367 views

Can I use 802.1x and LACP to secure the networking infrastructure?

Suppose you have a network like this: +-------------------------+ +---------------------------+ | | | ...
3
votes
5answers
6k views

Propagate VLAN through VPN (IPsec)?

I have a question about connecting two LANs (logically same LAN) over a VPN. In picture below you can see overall representation of our implementation. Description: On each side, we have distinct ...
1
vote
0answers
387 views

Configure a DLINK AP to connect to 802.1x LAN [closed]

My hostel is in the process of implementing AAA using 802.1x, PEAP + MSCHAPv2 on Ethernet. I have a DLINK 850L router, is it possible to configure it to connect to 802.1x? DD-WRT is not available for ...
31
votes
8answers
6k views

How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?

Is MAC address filtering the most suitable option to prevent someone connecting their own device to the network by plugging into Ethernet wall sockets? What if they unplug a device and clone its MAC?
5
votes
1answer
1k views

Cisco 3750 802.1x — Invalid Eapol packet length

Having a tough time here getting EAP-TLS to work. I am converting from a EAP-PEAP solution to EAP-TLS and have done the steps required for PKI so as to be not a certificate issue. (server and client ...
3
votes
1answer
1k views

EAP packets generated for plain MAC-based authentication

I wanted to implement trivial MAC-based authentication on some Cisco SG300 (small-business) switches. The client doesn't ask for auth but I simply want the client's MAC address to be authenticated, ...
2
votes
1answer
355 views

Per-user network authentication without mac-filtering

I am aware of MAC address filtering available on most wifi access points, but mac filtering doesn't establish a user identity, it only controls access on a device by device basis. One user may have ...
0
votes
1answer
134 views

Should Consumer Router plugged into dotx (802.1x) enabled port see only WAN MAC address?

Probably a quick question. I am testing my dotx (802.1x) deployment on an Access Layer switch. I want to know if I plug in a consumer router, like a Linksys or Netgear, will the dotx only see the WAN'...
5
votes
4answers
11k views

802.1x on Access VLAN only, not on Voice VLAN

I've successfully configured a Cisco 3750G to perform the authenticator function of the 802.1x process. I have a test Win7 machine as a supplicant and a Windows 2008 server running NPS as the ...
1
vote
1answer
581 views

Does 802.1X Multiple Hosts mode only work for access points or even through another switch?

802.1X Multiple Hosts mode is usually used when an access point acts as a supplicant and authenticates to the switch, then allows further hosts by bridging it to the wireless network. My question is ...
7
votes
3answers
11k views

Regarding Dot1X dynamic VLAN assignment

Situation: I am trying to get 802.1X working for me. I want RADIUS server to dynamically assign VLANs to ports based on RADIUS reply attribute for particular user. I have an HP E2620 switch and a ...
4
votes
1answer
5k views

Wireless (Ruckus) and Dynamic VLAN Assignment via Microsoft NPS

Our current 802.11 setup has a large number of SSIDs to segregate traffic by subnet. This isn't ideal, and I've been attempting to consolidate to a single SSID but use dynamic VLANs instead. This is ...
9
votes
1answer
2k views

Dell powerconnect 6248 voice vlan next to dot1x

We are testing currently dot1x auth against FreeRADIUS/AD in the network. The vlans are dynamically assigned by FreeRADIUS on AD-group base. This works, but now the problem comes: We wanted to add ...