34

MAC address filtering itself does not provide much protection. As you pointed out, a MAC address can be cloned. That doesn't mean it can't be part of the overall defense strategy, but it can be a lot of work for very little return. You need a comprehensive security policy which can include such things as: Physical access limitations 802.1X as @robut ...


10

That's a lot of questions, so let's take them one by one. What exactly is 802.1X Port-Based Authentication? From Wikipedia : IEEE 802.1X is an IEEE Standard for port-based Network Access Control (PNAC). It is part of the IEEE 802.1 group of networking protocols. It provides an authentication mechanism to devices wishing to attach to a LAN or WLAN. ...


9

Frankly, no. 802.1X authenticates the port and as long as it is authenticated it participates in the network. Inserted or even modified frames by an otherwise transparent network device cannot be detected. 802.1X has had some serious attack vectors from the start and can only be regarded as a "better than nothing" approach. If you want serious port ...


8

The protocol used between switch and authentication server is called RADIUS. The server address (or server addresses) have to be configured on the switch (manually) The switch must be configured as a "client" on the RADIUS server and both need the same shared secret in order to communicate with each other All assuming that basic routing between switch ...


7

I am aware of MAC address filtering available on most WiFi routers, but this is about access control on a device by device basis. One user may have many devices. Is there any way to control WiFi network access on a user by user basis? Use 802.1X with PEAP/MSCHAPv2. This authentication scheme will permit you to authenticate your users against a RADIUS ...


7

Use a VPN internally and treat the section of the network outside secure areas the same way you would treat the internet.


6

Alex, hеllo there! Ive builded test environmet for you, so i am using freeradius 2.1.12+dfsg-1.2 (on debian), and switch hp 2650. Ive just repeated your config, and have no problems with this. My test procurve ip 10.0.10.29, test freeradius ip 192.168.2.60. procurve config: Running configuration: ; J4899A Configuration Editor; Created on release #H.10.83 ...


5

802.1x was specifically designed for end-point devices to authenticate to network switches and was not designed for switch-to-switch connections. Because of this, it is highly unlikely that you will find any switches that can be a 802.1x client, so the answer to your Y question is no. To answer your X concern (see XY problem)- preventing a malicious entity ...


5

802.1x is port based. So, in simplest form, the port is either authorized or not; once authorized -- MAC limits aside -- traffic from anything will be allowed. Modern 802.1x systems are much smarter ("more complicated") and can independently police multiple hosts on a single port. This is where multi-auth and multi-domain come in. (consult Cisco here) As ...


5

It is better to be in the same channel as your interfering signals (if you can't find a free channel) rather than in overlapping channels that are not the same channel - if you are in a nearby channel, there is interference, but no communication. On the same channel, the spec requires some cordination to share the channel. Often your best actual bet is to ...


5

There is a quite nice and simple solution: We have utilized the voice VLAN to send Magic Packets. Voice VLAN is configurable under: ethernet-switching-options { voip { interface access-dot1x { vlan VOIP; forwarding-class assured-forwarding; } } } We were already using it to connect VoIP phones. The feature ...


5

The switch (authenticator) needs to be configured for 802.1X. One thing that needs to be configured is the address of the authentication server. It's usually an IP address and often it's routed. The authenticator couldn't use any information from the supplicant because it can't be trusted without being authenticated (or even after).


5

Welcome to Network Engineering! You might want to ask this on Information Security SE, but here are a few thoughts: If one has physical access to the network, an attacker can do lots of things. Attacking 802.1x is just one. The presentation lists some mitigation techniques, but they all rely on careful monitoring of network traffic -- something rarely done ...


5

Using QinQ (802.1ad) double tagging, you can use an inner (customer) VLAN ID and an outer (provider) VLAN ID. The point is that a provider can provide full, 802.1Q-tagged services to each client and still use the outer tag for their own VLAN infrastructure. Double tags can be used in plain frames or inside a (VPN) tunnel.


4

You would need to configure MAB (Mac Auth Bypass) authentication for the ip phone in the multi-vlan interface. You also need multi-auth so the switch knows to look for more than one MAC address. -authentication host-mode multi-auth -authentication order mab dot1x


4

I found the answer here: http://forums-archive.ruckuswireless.com/forums/8/topics/1278 NPS does not return AD group memberships back to the ZoneDirector without setting a vendor-specific attribute on NPS. A role has to be configured for each group on the ZoneDirector and a network policy has to be configured for each group on NPS. This seems rather ...


4

802.1X does perform either a computer or a user authentication to allow the network access. NAC is a generic term designing any form of Network Access Control. Then 802.1X is one kind of NAC. I consider 802.1X to be the standard of NAC. Beware here of the abbreviation collision around NAC which stands for Network Access Control and Network Admission ...


4

Answer to your question = No. I dont think there is one complete answer. The closest would be to have defence in depth. Start as Ron Maupin suggested as having Physical access restricted. Then have 802.1x using EAP-TLS to have authentication to the port. After that you can still have a firewall on the access/ditribution layer. If you are talking more ...


4

This is a well-known weakness of 802.1X. It protects well against casual misconduct but provides no full protection against a decided attack. You can somewhat reduce the weakness by combining 802.1X with MAC-port binding on the protected interfaces, but this can be overcome as well. If you require better security take a look at MACsec defined by IEEE 802....


4

There are many variables to consider when configuring LAN Authentication, but here is a page from the HP manual on configuring 802.1x, and here is one from the Freeradius Wiki. These two links should get you started.


3

RADIUS stands for Remote Authentication Dial-In User Service and was develop to authenticate, authorize and account (AAA) Dail-In users. Today it's often used as a centralized authentication server for the management interface for all kinds of networking devices. Another common use is 802.1X 802.1X is an IEEE standard used in wired and wireless LANs to ...


3

Yes, you can configure your RADIUS server to specify the VLAN for the user. Specifying an Authorized VLAN in the RADIUS Server Database The Internet Engineering Task Force (IETF) draft standard specifies a method for communicating vendor-specific information between the device and the RADIUS server by using the vendor-specific attribute (attribute ...


3

Presumably, the outer vlan ID is used if you want to carry both your VXLAN trunk and a bunch of other non-VXLAN VLANs together on a traditional 802.1q trunk. So you end up with an outer .1q trunk just like you've always done, and an inner VXLAN trunk. The switches involved in this trunk have no knowledge of VXLAN, to them it's just another flow, like any ...


3

what I mainly want to know from someone who has already gone through all this is: Is a "MAC authentication" that still generates EAP packets a valid approach? Here's a freeradius-users thread which answers most of these questions. The crux is: Using EAP for MAC auth makes no real sense. But it isn't bad either if it's at least correctly implemented. Users ...


3

No because MAC addresses are easily spoofed. 802.1x is the proper tool for the job. With 802.1x, one of the connections methods could be, when you connect (whether wireless or wired), you are sent to a captive portal (aka splash page) via your browser where you can accept the terms of use, optionally enter a required password, etc.


3

802.1X EAP frames are supposed to only be used between the client (supplicant) and its uplink switch (authenticator). The authenticator then uses a higher layer protocol for communication with the authentication server. The higher layer protocol can be switched and routed as desired. You cannot use 802.1X authentication across several switches. Essentially, ...


3

After reaserch I found working config. [HP1920-[21]]display current-configuration interface GigabitEthernet1/0/24 # interface GigabitEthernet1/0/24 port link-type hybrid undo port hybrid vlan 1 port hybrid vlan 131 untagged loopback-detection enable stp edged-port enable dot1x re-authenticate dot1x max-user 1 ...


3

Whether the receiver removes the Q tag right away or keeps it for further processing is its own decision. On a switch, this depends on whether the VLAN ID in question is tagged on the destination port (trunk port) or untagged/native (access port). Even on an untagged port, the Q tag may sometimes still be present to preserve PCP priority but with a zeroed ...


3

LACP and 802.1X don't mix. Unless there are vendor-specific extensions allowing that(?) you can't use them simultaneously on a port. Link aggregation is normally used between switches or towards hosts/servers. You don't usually and shouldn't use 802.1X port authentication on those links anyway. You use port authentication when you can't trust ports exposed ...


3

802.1X is a standard for port-based network access control (NAC). It belongs to the IEEE 802.1 family, defining (mostly) data link layer standards (bridging). 802.11 is a standard for wireless networks with various physical layer variants, often called Wi-Fi or wireless LAN / WLAN. 802.11 commonly uses 802.1X for client authentication, but apart from that ...


Only top voted, non community-wiki answers of a minimum length are eligible