11 votes
Accepted

What's the difference between RADIUS and 802.1X Port-Based Authentication?

That's a lot of questions, so let's take them one by one. What exactly is 802.1X Port-Based Authentication? From Wikipedia : IEEE 802.1X is an IEEE Standard for port-based Network Access Control ...
hertitu's user avatar
  • 2,658
9 votes

Mitigating 802.1x bypass by transparent bridging

Frankly, no. 802.1X authenticates the port and as long as it is authenticated it participates in the network. Inserted or even modified frames by an otherwise transparent network device cannot be ...
Zac67's user avatar
  • 84.4k
6 votes
Accepted

In 802.11 Wi-Fi, Is it better to be on the same channel as other networks instead of being in an overlapping channel?

It is better to be in the same channel as your interfering signals (if you can't find a free channel) rather than in overlapping channels that are not the same channel - if you are in a nearby channel,...
Ecnerwal's user avatar
  • 2,746
5 votes

Mitigating 802.1x bypass by transparent bridging

Welcome to Network Engineering! You might want to ask this on Information Security SE, but here are a few thoughts: If one has physical access to the network, an attacker can do lots of things. ...
Ron Trunk's user avatar
  • 67.5k
5 votes

When doing 802.1X port authentication, how does the switch know how reach the authentication server?

The switch (authenticator) needs to be configured for 802.1X. One thing that needs to be configured is the address of the authentication server. It's usually an IP address and often it's routed. The ...
Zac67's user avatar
  • 84.4k
5 votes
Accepted

Can I use 802.1x and LACP to secure the networking infrastructure?

802.1x was specifically designed for end-point devices to authenticate to network switches and was not designed for switch-to-switch connections. Because of this, it is highly unlikely that you will ...
halfmetaljacket's user avatar
5 votes
Accepted

Juniper: WakeOnLan over 802.1x without using default VLAN

There is a quite nice and simple solution: We have utilized the voice VLAN to send Magic Packets. Voice VLAN is configurable under: ethernet-switching-options { voip { interface access-...
Michał Sacharewicz's user avatar
5 votes
Accepted

Whats the meaning of `802.1Q tunnel customer VLAN mapping` and `802.1Q tunnel provider VLAN mapping`?

Using QinQ (802.1ad) double tagging, you can use an inner (customer) VLAN ID and an outer (provider) VLAN ID. The point is that a provider can provide full, 802.1Q-tagged services to each client and ...
Zac67's user avatar
  • 84.4k
4 votes
Accepted

How does NAC or NAP enhance 802.1X?

802.1X does perform either a computer or a user authentication to allow the network access. NAC is a generic term designing any form of Network Access Control. Then 802.1X is one kind of NAC. I ...
dan's user avatar
  • 364
4 votes
Accepted

802.1X on wired networks

This is a well-known weakness of 802.1X. It protects well against casual misconduct but provides no full protection against a decided attack. You can somewhat reduce the weakness by combining 802.1X ...
Zac67's user avatar
  • 84.4k
4 votes

secure authentication over LAN 802.1X

There are many variables to consider when configuring LAN Authentication, but here is a page from the HP manual on configuring 802.1x, and here is one from the Freeradius Wiki. These two links ...
Ron Trunk's user avatar
  • 67.5k
3 votes
Accepted

Does 802.1Q protocol will remove the VLAN tag in the received place?

Whether the receiver removes the Q tag right away or keeps it for further processing is its own decision. On a switch, this depends on whether the VLAN ID in question is tagged on the destination ...
Zac67's user avatar
  • 84.4k
3 votes
Accepted

Guest VLAN doesn't work at wired connection on HP 1920 JG927A

After reaserch I found working config. [HP1920-[21]]display current-configuration interface GigabitEthernet1/0/24 # interface GigabitEthernet1/0/24 port link-type hybrid undo port ...
Mr. NoNe's user avatar
3 votes

Will all switches pass 802.1x EAP seamlessly? Any caveats?

802.1X EAP frames are supposed to only be used between the client (supplicant) and its uplink switch (authenticator). The authenticator then uses a higher layer protocol for communication with the ...
Zac67's user avatar
  • 84.4k
3 votes
Accepted

VLAN management in 802.1X

Yes, you can configure your RADIUS server to specify the VLAN for the user. Specifying an Authorized VLAN in the RADIUS Server Database The Internet Engineering Task Force (IETF) draft standard ...
John K.'s user avatar
  • 969
3 votes
Accepted

VxLAN optional outer 802.1Q purpose?

Presumably, the outer vlan ID is used if you want to carry both your VXLAN trunk and a bunch of other non-VXLAN VLANs together on a traditional 802.1q trunk. So you end up with an outer .1q trunk just ...
Jeremy Gibbons's user avatar
3 votes

How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?

No because MAC addresses are easily spoofed. 802.1x is the proper tool for the job. With 802.1x, one of the connections methods could be, when you connect (whether wireless or wired), you are sent ...
Ronnie Royston's user avatar
3 votes

using 802.1x with nic teaming

LACP and 802.1X don't mix. Unless there are vendor-specific extensions allowing that(?) you can't use them simultaneously on a port. Link aggregation is normally used between switches or towards ...
Zac67's user avatar
  • 84.4k
3 votes
Accepted

Difference between 802.1X vs 802.11 standards

802.1X is a standard for port-based network access control (NAC). It belongs to the IEEE 802.1 family, defining (mostly) data link layer standards (bridging). 802.11 is a standard for wireless ...
Zac67's user avatar
  • 84.4k
3 votes

What's the difference between DIAMETER and 802.1X Authentication?

802.1X provides client-side/front-end port-level authentication (between suplicant and authenticator). RADIUS and Diameter provide back-end authentication (between authenticator and authentication ...
Zac67's user avatar
  • 84.4k
2 votes
Accepted

Can you change your MAC and IP address on 802.1X port?

And as was said in the other question, 802.1x is a layer-2 protocol. It is unaware of any layer-3 protocol(s). Changing your MAC can have several outcomes depending on the particular setup, ranging ...
Ricky's user avatar
  • 32.2k
2 votes
Accepted

Is 802.1x port security enforces IP uniqueness

dot1x only establishes the user's identity; it has nothing to with IP addressing
Mike Pennington's user avatar
2 votes
Accepted

802.1X for Wi-FI

To answer your first question, Yes someone with a wireless sniffer will be able to find your "hidden" SSID by examining probe requests from clients that are already configured to connect to that SSID. ...
Neil Johnson's user avatar
2 votes
Accepted

AAA & NAC: Use last authorized vlan of a port, if AAA-Server is dead?

If you are using 802.1x on a cisco switch, you can configure the interface to fallback to an authorized vlan if the server is dead. authentication event server dead action authorize vlan XX ...
John K.'s user avatar
  • 969
2 votes
Accepted

What are connectivity associations in LAN? - IEEE Std 802.1X-2010

In a connectionless communication, the only association is made between the end parties. The Internet is a good example of this. When you browse a website, you send data to the web server, and it ...
Ron Trunk's user avatar
  • 67.5k
2 votes
Accepted

Dot1x re-authentication for computers connect via IP phone

I have figured out that our Alcatels IP phones are not capable of sending EAPoL-Logoff messages on behalf of the data device, when phone detects that device has unplugged from behind the phone. ...
Daniel Blazek's user avatar
2 votes
Accepted

Can't use "dot1x" command in Cisco Packet Tracer

Packet tracer does not use real IOS but emulate devices with an IOS-like environment. This software is really made by Cisco for entree-level Cisco courses, so it includes what is relevant to those ...
JFL's user avatar
  • 19.7k
2 votes

Juniper: WakeOnLan over 802.1x without using default VLAN

A WoL magic packet needs to contain the magic (FF:FF:FF:FF:FF:FF followed by 16 times the destination's MAC address) anywhere within its payload. It doesn't matter if you send it in an (unpractical) ...
Zac67's user avatar
  • 84.4k

Only top scored, non community-wiki answers of a minimum length are eligible