Questions tagged [ieee-802.1x]

For questions about the 802.1X protocol for port-based network access control.

Filter by
Sorted by
Tagged with
0 votes
1 answer
39 views

Connecting a hub to my switch bypasses RADIUS/802.1X

I have set up a windows nps server (radius), it works with eap-tls. In the switch when the authentication is validated the port is passed in vlan 100 and when it is refused it is passed in vlan 101. ...
Nivys's user avatar
  • 1
0 votes
1 answer
61 views

Single SSID w/PSK to default VLAN, Secondary Auth EAP-TLS to a second VLAN

I'm wondering if the following is possible given the limitations/constraints of RADIUS, CoA, and fundamental limits of 802.11 authentication, etc. I would like a wireless configuration with a single ...
user3814483's user avatar
0 votes
1 answer
21 views

DOT1X: A practical case for ForceUnauthorized state

I have been working as a Network Engineer for almost 5 years now. I have never encountered a scenario where I would need to configure a Cisco switch port as ForceUnauthorized (DOT1X). According to the ...
AhmedWas's user avatar
  • 273
0 votes
1 answer
54 views

802.1x EAP-TLS certificates protection [closed]

I am trying to configure the network in my small office so that only specific devices can connect to the Ethernet ports. I have read that it is best to use 802.1x and EAP-TLS as the most secure method....
bLAZ's user avatar
  • 111
1 vote
1 answer
126 views

Is the EAP-Request/Identity and EAP-Response/Identity transmitted in the clear in a WPA2 entreprise Wi-Fi setup?

Looking at the WPA2 (Entreprise, let's say PEAP-MSCHAPv2) Wi-Fi protocol, I understand that since WPA2 uses Open System Authentication, and that 802.1X authentication takes place before the 4-way ...
user avatar
-1 votes
2 answers
1k views

Can't ping the second network interface connected to a switch [closed]

I have the following topology: Default Gateway1 <--> SWITCH1 <--> [ NIC2 - (Windows 10 PC) - NIC1 ] <--> SWITCH2 <--> Default Gateway2 --> Internet NIC1 is DHCP configured, ...
Somayyah Mohammed's user avatar
1 vote
1 answer
179 views

ARP isn't showing all the interfaces/MAC bindings

I'm playing with Dot1x port authentication, the interface G2/0/2 is connected to a PC and is authenticated/authorized successfully: SW1-2960#show authentication sessions int g2/0/2 det ...
Somayyah Mohammed's user avatar
0 votes
1 answer
1k views

Network Protocol vs Framework?

I've been a network engineer for almost 4 years now. I thought I understand what a network protocol means. but now I'm having doubts. For me, Ethernet is a protocol used at layer 2. there would be ...
Shehab White's user avatar
0 votes
1 answer
80 views

is DIAMETER-EAP Authentication method mutual or one way?

i'm studying the DIAMETER-EAP authentication method and i would like to know if this method can be considered mutual authentication or "one way" authentication. In my opinion this is one way ...
user69377's user avatar
0 votes
1 answer
319 views

What's the difference between DIAMETER and 802.1X Authentication?

I'm studying the 802.1.X authentication guidelines and the DIAMETER protcol as successor of RADIUS but i can't figure out what are the main difference between pure 802.1X Port-Based Authentication and ...
Raydar's user avatar
  • 21
0 votes
0 answers
181 views

802.1x and mab with ip phone and pc beyond it

I have 2 switches . Hp2620 and 2610. I have an ip phone connected to the switch(i use mab to authenticate) and pc(connected to the ip phone) with dot1x. Each work individually bu they dont work ...
user19215's user avatar
  • 313
2 votes
1 answer
134 views

MACsec Switch-to-Switch authentication/encryption

I have some questions regarding MACsec IEEE 802.1 AE-2018 and PNAC IEEE 802.1X-2010. As I have heard there is no swich-to-switch protection with 802.1X-2010 by this standard I want to know where is ...
user234123's user avatar
1 vote
1 answer
8k views

Difference between 802.1X vs 802.11 standards

What does the x means in 802.1x and which are the differences between the 802.1X and 802.11 standards ? Can you explain to me ?
AleWolf's user avatar
  • 135
0 votes
1 answer
236 views

Vlan Command Issues on Cisco Switches

I'm new to cisco equipment. I have GNS3 emulating an L3 switch whose image is "i86bi-linux-l3-adventerprisek9-15.5.2T.bin". I want to create a cable network with 802.1x and vlan authentication. For ...
Tomás's user avatar
  • 113
0 votes
1 answer
274 views

Netgear GS608v2 switch + 802.1x [closed]

Does anyone know what the difference is between GS608v2 versus GS608v3? I started noticing that machines connected to GS608v2 were not getting full network access (no internal connection) when 802.1x ...
as134_user3693277's user avatar
0 votes
1 answer
441 views

802.1x Multiple Devices

I'm in the process of implementing wired 802.1x. I've been testing with HP 2530 switches and everything seems to work okay enough. On a different site I use Brocade (now Ruckus) 6450 switches. I ...
John Sayce's user avatar
0 votes
0 answers
427 views

802.1X MAC auth : Dell N2048 switch returns malformed EAP packet

I'm trying to set up MAC authorization with 802.1X using FreeRADIUS, a Dell N2048 (DN OS6.3.3.9) switch as the authenticator and a Ubuntu machine as the supplicant. I've followed this guide for ...
Pro-oui's user avatar
  • 11
0 votes
2 answers
335 views

Multiple 802.1x clients, single port support on a Cisco 3750 switch?

I'm thinking of using our Cisco 3750 switch with our RADIUS server for 802.1x authentication on our Ethernet ports. If I enable 802.1x and a user connects a switch to their Ethernet jack, and the ...
slantalpha's user avatar
0 votes
1 answer
60 views

Radius and certificates

I'm trying to understand something. When a client and the radius server start the connection how does things work? Is it always a tls connection and does it use the symmetric encryption after ...
user19215's user avatar
  • 313
1 vote
1 answer
400 views

using 802.1x with nic teaming

I am working on a project which is mandatory to have each pc configured with two network interface cards as a nic team. I want to use 802.1x for authentication with a radius server like cisco ISE. My ...
665bassem's user avatar
0 votes
1 answer
188 views

How to change ip TTL=1 on flat network for security [closed]

Working on a network at an high rise apartment complex. They have a core router/firewall acting as dhcp server and about 7 switches (all l3 switches). They have a few vlans to segment traffic based of ...
ITWeasel's user avatar
1 vote
2 answers
104 views

802.1X Auth for Clients and Servers

I'm about to introduce 802.1X Authentication to my current network for wifi and wired connections: My Setup: I have a Windows Domain Controller and I wanted to use the Network Policy Service for ...
1337's user avatar
  • 11
2 votes
1 answer
106 views

secure authentication over LAN 802.1X

secure authentication over LAN I have installed FreeRadius Version 3.0.12 server, we debian 9.4.0, and I want to secure my LAN, that means, nobody can connect to the LAN if its MAC address is not ...
Abdesslam Hassnioui's user avatar
3 votes
1 answer
298 views

Cisco Nexus 5548 802.1x Guest-VLAN not available

I'm trying to configure a Cisco Nexus 5548 for 802.1x using MAC Authentication Bypass. I'm finding that there isn't an option to configure the guest VLAN in the event that authentication fails. ...
dutsnekcirf's user avatar
1 vote
1 answer
322 views

Whats the meaning of `802.1Q tunnel customer VLAN mapping` and `802.1Q tunnel provider VLAN mapping`?

Whats the meaning of 802.1Q tunnel customer VLAN mapping and 802.1Q tunnel provider VLAN mapping? Shows 802.1Q (QinQ) tunnel information. 802.1Q tunneling allows layer 2 VPN connectivity between ...
244boy's user avatar
  • 1,767
1 vote
2 answers
102 views

What is the purpose of 802.11 authentication? [duplicate]

Why does client authenticate before associating with the AP. What does open system authentication even achieve. I fail get an accurate reason from my web searches.
Ganapathi Bhat's user avatar
3 votes
2 answers
4k views

Does 802.1Q protocol will remove the VLAN tag in the received place?

Does 802.1Q protocol will remove the VLAN tag in the received place? Such as the VLAN 10 trough 802.1Q protocol to pass frames. the 802.1Q will add 802.1q header(tag) and recalculate CRC/FCS like ...
three-blocks's user avatar
1 vote
0 answers
250 views

Network segmentation with VLAN and MAC auth: thoughts about implementation

Currently we have a medium-sized, flat network with some DHCP pools. This configuration isn't satisfying us anymore, as everyone can see everything on the network and it may leads to security issues. ...
Pro-oui's user avatar
  • 11
0 votes
1 answer
1k views

Cisco 2960-S switch with MAB and Packetfence Web Authentication

I am trying to set up Packetfence In my corporate environment for guest users, with MAC access bypass. i have done everything like in the official Packetfence installation guide https://packetfence....
bkalcho's user avatar
  • 101
7 votes
2 answers
3k views

Mitigating 802.1x bypass by transparent bridging

The talk DEFCON talk "A Bridge Too Far" details a means to bypass wired 802.1x network access controls by setting up a transparent bridge between a genuine machine and the network. Once authentication ...
Cybergibbons's user avatar
2 votes
1 answer
463 views

Guest VLAN doesn't work at wired connection on HP 1920 JG927A

I'm tring to get properly working configuration on HP 1920 with dot1x and guest-vlan. All my authenticated computers works fine also auth-fail vlan is working properly. Any One has idea what can be a ...
Mr. NoNe's user avatar
3 votes
2 answers
747 views

When doing 802.1X port authentication, how does the switch know how reach the authentication server?

So, while I get the supplicant-authenticator-authentication server structure (for the most part), the part that bugs me is the step when the switch starts communicating with the authentication server; ...
Xovvo's user avatar
  • 95
3 votes
3 answers
9k views

802.1x and use Google G Suite Directory as LDAP

Has anyone managed to authenticate yours to the network via 802.1x using Google Directory? I have a case where whole company is using Google Apps and G-Suite with a custom domain and they would like ...
lowk3y's user avatar
  • 33
1 vote
2 answers
2k views

Will all switches pass 802.1x EAP seamlessly? Any caveats?

We have a selection of Unifi, Meraki and Arista switches. We're currently trying to sort out our 802.1x/RADIUS infrastructure It seems like Meraki has the best 802.1x support (e.g. supporting multi-...
victorhooi's user avatar
3 votes
1 answer
243 views

802.1X on wired networks

Suppose i'm protection physically accessible RJ45 sockets in offices that are connected to a switch (Cisco SF220) with 802.1X port based authentication and a radius server. Authorized devices have ...
xuma202's user avatar
  • 133
2 votes
1 answer
995 views

Dot1x re-authentication for computers connect via IP phone

I am currently working on dot1x solution for wired users. Configuration we have is working fine for most of our use cases, except one. We have working solution for users that are connected to the ...
Daniel Blazek's user avatar
2 votes
2 answers
2k views

Can't use "dot1x" command in Cisco Packet Tracer

I am trying to configure 802.1X authentication on a Cisco switch 2960 in Cisco Packet Tracer software. Here I found the offical guide: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/...
李元秋's user avatar
  • 123
5 votes
2 answers
859 views

Juniper: WakeOnLan over 802.1x without using default VLAN

Case We have a working 802.1x configuration on all our access ports. I want to enable WakeOnLan, but have no idea, how to target computers with Magic Packet. Tests We tried to send Magic Packet ...
Michał Sacharewicz's user avatar
1 vote
1 answer
125 views

What are connectivity associations in LAN? - IEEE Std 802.1X-2010

In IEEE Std 802.1X-2010, Appendix D, Section D.8, there is the following phrase However simple or complex, the establishment of a connectivity association for connectionless data transfer ...
Shashank V's user avatar
1 vote
1 answer
1k views

Is PMKID same for a specific client when it is roaming from AP1 to AP2 using WPA2-Enterprise?

I have two access points (APs) setup with the same SSID name and using the same freeRADIUS server for station authentication. I have read Cisco documentation about fast roaming. So I have this doubt ...
NayabSD's user avatar
  • 113
3 votes
1 answer
595 views

AAA & NAC: Use last authorized vlan of a port, if AAA-Server is dead?

I'd like to know if there is any way to configure the switch so, that in case the radius-server is dead and devices try to (re)-authenticate the port gets the latest vlan which was authorized on this ...
JMAD2016's user avatar
3 votes
1 answer
157 views

In 802.11 Wi-Fi, Is it better to be on the same channel as other networks instead of being in an overlapping channel?

While being on the same channel as another network is not ideal, is it better than being on a neighboring overlapping channel because 802.11 specification has methods for dealing with co-channel ...
marcanuy's user avatar
  • 133
1 vote
1 answer
165 views

VLAN management in 802.1X

I would like to learn how is VLAN management in 802.1X port based authentication. Are there something specific in 802.1X about VLANs? Because VLAN is also part of Layer 2.
typos's user avatar
  • 181
3 votes
1 answer
995 views

How does NAC or NAP enhance 802.1X?

I'm studying about 802.1X port based authentication and RADIUS, and I came across the terms of NAC (Network Admission Control) and NAP (Network Access Protection). As long as I know NAC tries to unify ...
typos's user avatar
  • 181
1 vote
1 answer
1k views

802.1x authentication and dynamic VLAN assignment of VLAN tagged frames

I want to implement a Network Access Control ( NAC ) infrastructure in my LAN. My topology is something like: PC -> ( Untagged Port - PVID 100 - Non 802.1x capable smart switch ) -> ( Hybrid port - ...
Manuel Lapeyre's user avatar
10 votes
2 answers
49k views

What's the difference between RADIUS and 802.1X Port-Based Authentication?

As long as I know RADIUS is a type of authentication protocol, where for example if someone wants to use a switch, it first of all needs to enter his/her credentials, and properly authenticate himself/...
user avatar
1 vote
1 answer
364 views

Can you change your MAC and IP address on 802.1X port?

It's related to this question: Is 802.1x port security enforces IP uniqueness If you have 802.1X port security can you change a MAC address of your device (to some other unused MAC address)? Will it ...
Victor Ronin's user avatar
3 votes
1 answer
87 views

Is 802.1x port security enforces IP uniqueness

I know that 802.1x can track MAC addresses. If MAC address is used on one port then you can prohibit it from being used on another port. Can 802.11x protocol do the same thing for IP addresses? My ...
Victor Ronin's user avatar
1 vote
1 answer
669 views

VxLAN optional outer 802.1Q purpose?

So, I've been checking Google along with the RFC 7348 about VxLAN functionality. I believe I do have a good grasp of what the purpose of the protocol is, what it does and how it does it etc but I fail ...
Kounavi's user avatar
  • 113
1 vote
1 answer
207 views

802.1X for Wi-FI

I have a hidden SSID network. I know that although the SSID is hidden, someone can sniff the Wi-Fi channels to get my SSID, and with that SSID he can use some OpenWRT-ish things to spoof my Wi-Fi ...
Edik Mkoyan's user avatar