thanks prem,

let me go through some of those docs and get back.

regards,

Shobith

Hi,

Thanks for the reply. Current requirement was to make most use of the Cisco ACS server deployed in the system. Can we have any other option other than 802.1x/CCA.

Can we implement port based authentication , ie authenticating the PC connected, based on a list of mac addresses. Also can this functionality be integrated with Cisco ACS, coz the network has more than 3000 nodes ( 3000 mac addresses.)

It would be great if i can have more inputs on the same.

Thanks,

Shobith.K

Hi Shobithk,

First of all let me clarify what I said earlier, when I said cisco doesn't recommend dot1x in a large complex enviornment, that is more related to a framework deplyoment and that's why I made the suggestion of CCA. Dot1x is deployable, and in your particular case, it may be a viable option provided you have done ample planning and looked at all the variables. I would highly recommend you to work with your Cisco account team to craft a good solution.

Best regards,

Raj

I have done this earlier, do not know if its feasible for you or not. You'll find it no where which will say like, mac authentication using Cisco switches. But if your switches support MAC auth bypass. Then you can do this (I have done this twice and it works, but test first),

You can go through MAC Auth bypass feature from following link:

12.2(37)SE - "Using IEEE 802.1x Authentication with MAC Authentication Bypass"

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat3750/12237se/scg/sw8021x.htm#wp1205506

Configuring MAC Auth bypass on 12.2(37)SE:

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat3750/12237se/scg/sw8021x.htm#wp1196845

----------Commands Required on Switch--------------

aaa new-model

aaa authentication dot1x default group radius

dot1x system-auth-control

radius-server host

radius-server key

config t

interface

switchport access vlan

dot1x port-control auto

dot1x mac-auth-bypass

dot1x timeout quiet-period 15

dot1x timeout tx-period 3

dot1x reauthentication

-----------------------------------------------------------------

If we have an Windows XP Client, and as we want MAC authentication to work, then we can disable client to sent EAP request, so that Switch can consider it as Agentless host, and initiates the MAC auth bypass process.

Registry fix on Win XP test machine,

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EAPOL\Parameters\General\Global]

"SupplicantMode"=dword:00000000

Please create a AAA Client entry for the switch in ACS from Network configuration section.

And use the Authentication Protocol as RADIUS (Cisco IOS....)

And on ACS create an account for the client as,

Username : 0015c53ae40d

Password : 0015c53ae40d

If the MAC address of the client is 00-15-C5-3A-E4-0D

Also, please ensure that we running ACS version that is not hitting bug,

CSCsh62641 - MAC authentication causes internal errors

Regards,

Prem

dot1x mac-auth-bypass not supported for 2950 switches.

Hi Prem,

Thanks for the assistance provided. I have tested the configuration provided by you, in the lab. It works :)

Now moving on to integrate with our existing LAN, I have to test the following,

1) A PC and an IP Phone connecting to the same port to be authenticated based on MAC address.

I went through the 802.1x configuration guide and I came across MULTI DOMAIN AUTHENTICATION which lets me authenticate both PC and IP Phone. Now I have a doubt here. Will this work with MAC-AUTH-BYPASS. Hope to hear from you soon regarding this.

Thanks and Regards,

Shobith

Yes, this is exactly what you need.

Multi-Domain-Auth is effectively a new host mode. Typically, port-based access-control techniques only take a single-port into account. For AAA, and port-enforcement to insure the validity of the authorized session, MDA extends this to a single-port, single-VLAN construct to maximize retention of security.

So in the end, MDA just allows the new mode on the port. Then, MAB can be used as the actual auth method, and/or 1X can be used as the actual auth method; for both a Data-VLAN, and/or Voice-VLAN.

Hope this helps,