That's a lot of questions, so let's take them one by one.
What exactly is 802.1X Port-Based Authentication?
From Wikipedia :
IEEE 802.1X is an IEEE Standard for port-based Network Access Control
(PNAC). It is part of the IEEE 802.1 group of networking protocols. It
provides an authentication mechanism to devices wishing to attach to a
LAN or WLAN.
It seems that this line is missing from the c2600...
aaa authorization exec default group radius local
Exec authorization is what gives a login session the ability to pay attention to priv information from the RADIUS server.
Radius is a networking protocol, aimed at Authentication, Authorization, and Accounting.
It is not designed to backup configurations.
Now a device that can act as a Radius server may be able to perform other roles, like a FTP server on which a network device can backup is config, especially if you radius server is Linux or Windows machine. But this has ...
Alex, hеllo there!
Ive builded test environmet for you, so i am using freeradius 2.1.12+dfsg-1.2 (on debian), and switch hp 2650. Ive just repeated your config, and have no problems with this. My test procurve ip 10.0.10.29, test freeradius ip 192.168.2.60.
; J4899A Configuration Editor; Created on release #H.10.83
According to my experience the two most common issues when dealing with AAA and Radius are:
Misspelled/Absent pre-shared key on the RADIUS server or on the NAC (Radius client)
The Radius server misses the configuration to allow requests from a client.
Doing troubleshooting with comments it turned out that the pre-shared key was missing on the router.
Here's a generic example of a Cisco device. The localadmin user can only use the console port, unless tacacs is not available, in which case the user can login remotely.
username localadmin password xyz priv 15
aaa authentication login CONSOLE local
aaa authentication login VTY group tacacs+ local
aaa authorization exec VTY if-authenticated
The 2910al supports 802.1X port security as authenticator, using RADIUS over EAP or PEAP. Depending on your exact goals, an additional router is not required but you do need a RADIUS server. Check the 2910's "Access and Security Guide" chapter 13. If you've got nothing local to use as a RADIUS server you'll need a router to connect elsewhere - however, you ...
For your home router to establish a WAN connection to your ISP, a few things specific to PPP must happen first.
You may also have to do some research on LCP and NCP.
Check this link below, it may have the answer you are looking for (see the excerpt on PPPoE below):
There are many variables to consider when configuring LAN Authentication, but here is a page from the HP manual on configuring 802.1x,
and here is one from the Freeradius Wiki.
These two links should get you started.
It is possible, although it is generally not considered a good practice.
WAN providers used to use different protocols for WAN circuits (frame-relay, HDLC, PoS, etc.), so a router was needed to connect the differing network types.
Now, more commonly the WAN providers can provide Ethernet circuits between sites. So in theory, you could connect two switches ...
RADIUS stands for Remote Authentication Dial-In User Service and was develop to authenticate, authorize and account (AAA) Dail-In users. Today it's often used as a centralized authentication server for the management interface for all kinds of networking devices. Another common use is 802.1X 802.1X is an IEEE standard used in wired and wireless LANs to ...
In short, your client does not interact directly with the RADIUS server, the head-end router does.
Your client speaks to the head-end router, which is configured to only allow authenticated connections, so it queries the client for authentication. Your client responds to the head-end router, which forwards an authentication to the RADIUS server, which says ...
what I mainly want to know from someone who has already gone through all this is: Is a "MAC authentication" that still generates EAP packets a valid approach?
Here's a freeradius-users thread which answers most of these questions.
The crux is:
Using EAP for MAC auth makes no real sense.
But it isn't bad either if it's at least correctly implemented.
Have a look @ http://blog.ipspace.net/2011/09/ipv6-mplsvpn-6vpe-with-pppoe-and-radius.html
Is this what you are trying to achieve?
They confirm that:
Cisco-AVPair += "ip:vrf-id=vrf-name",
Cisco-AVPair += "ip:ip-unnumbered=Loopback301"
would only work with IPv4.
In order to make IPv6 work, you would need the following:
cisco-avpair += "lcp:interface-...
I do not want users to use their windows credentials (so they do not connect phones) - Users are not allowed to know the password (same reason)
As you mentioned Windows and ACS, you can still use user credentials via dot1X and not allow them to connect via phones. As long as you're doing Machine auth in ACS and requiring computer authentication in Windows ...
WLCs are NOT Radius Servers, you need an external Radius server and then point the WLCs to it
The page you are on right now is to configure credentials to actually be able to query the external radius server: IP Address & Ports, Shared Secret, and other connectivity options.
Cisco Radius servers are called ACS (secure Access Control System) and to ...
The mistake/oversight in my config is here:
aaa authentication login default local group radius
Using the radius keyword at the end instead of the explicit name of the RADIUS group defined elsewhere means the AAA system does not correctly use that RADIUS group. The correct AAA configuration command is this:
aaa authentication login default local group ...
I see you put the tag of aironet, so that I assume you are using Cisco WLC.
I used to manage this kind of WLC HA and I can be sure that both WLCs share the same IP address (here is 22.214.171.124) as long as you configured them properly.
Cisco also states this in their Cisco WLC Configuration Guide:
Information About High Availability
Actually this is relatively easy. Yes, you need AAA, but you don't need an external server.
aaa authentication ppp default local
aaa authorization network default local
aaa attribute list Static-126.96.36.199
attribute type ip-address "188.8.131.52" protocol ip
username static privilege 0 password XXXX
username static aaa attribute list Static-184.108.40.206
You can use ...
LACP and 802.1X don't mix. Unless there are vendor-specific extensions allowing that(?) you can't use them simultaneously on a port.
Link aggregation is normally used between switches or towards hosts/servers. You don't usually and shouldn't use 802.1X port authentication on those links anyway.
You use port authentication when you can't trust ports exposed ...
802.1X provides client-side/front-end port-level authentication (between suplicant and authenticator). RADIUS and Diameter provide back-end authentication (between authenticator and authentication server).
Essentially, they are different things. 802.1X is an application while RADIUS/Diameter can potentially provide authentication for various applications.
I am on the 1st phase of implementing a similar solution. 802.1x it's been for a while now and although it's grown up and globally supported it's vulnerable when meeting local OS network stack. I have deployed it several times on small and medium networks and usually it works for 90% of the workstations, maybe 95%. There is always an old Windows install that ...
Wow, I would have never though of this one. It was just a random solution.
So, the problem was with authorize section in my default site configuration at /etc/raddb/sites-enabled/default, it was kind of default. I don't really know what's up with that (if you, guys, know, comment on that, please), gonna do some research on that; here it is:
ok = ...
Could you test this out, after hours, requires a switch reboot?
system mtu jumbo 9000
Windows Server 2008R2 config:
adjust MTU to 9000
This may help. Take a look at this article if you haven't already figured this out: http://www.cisco.com/c/en/us/support/docs/lan-switching/8021x/118634-technote-eap-00.html
Normally you'd have two SSID's, one "company" SSID and one "guest" SSID that maps to their respective VLAN's. However, you could use something like NAC (Network Admission Control) and "trick" the RADIUS server to send an admission deny for clients authenticating with the guest credentials. Check out this doc from Cisco: NAC Support for MBSSID
One way to solve this problem is to change the AP connection to a layer 2 trunk with both VLANs on the trunk. You can have two different SSIDs (one for users, one for guests) and each SSID is associated with a VLAN. When a client connects to the Guest SSID, her data goes on VL 200; a regular user's data goes on VL 100.
You will need separate DHCP scopes ...