Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Control access to LAN via Radius

Is it possible use radius to control access of devices to network by using their mac addresses to authenticate to a cisco swich port via radius and assign the vlan to the port via the radius too ?

Regards

Mohamed

5 REPLIES
New Member

Re: Control access to LAN via Radius

look at 802.1x

New Member

Re: Control access to LAN via Radius

Hi,

I don't want to authenticate with username and password

Only to check the mac address and assign the VLAN according to the MAC address of the device

Regards

Mohamed

Re: Control access to LAN via Radius

Hi,

I just completed this very setup just last week. You can use dot1x with Mac Auth Bypass.

See here... http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/31sg/configuration/guide/dot1x.html#wp1203853

My Config was as follows;

On the RADIUS server configure both the username and password as the PC/Laptop MAC address.

Also on the RADIUS server configure these options... i used Cisco ACS RADIUS Server.

?Tunnel-Type = VLAN

?Tunnel-Medium-Type = 802

?Tunnel-Private-Group-ID = (VLANNumber)

Now globally on the switch configure this;

!

aaa new-model

aaa authentication dot1x default group radius

aaa authorization network default group radius

!

dot1x system-auth-control

!

radius-server host 172.16.0.1 auth-port 1645 acct-port 1646 key cisco

radius-server source-ports 1645-1646

radius-server deadtime 1

!

And on the interfaces configure this;

!

interface FastEthernet 0/1

switchport mode access

switchport nonegotiate

dot1x mac-auth-bypass

dot1x pae authenticator

dot1x port-control auto

dot1x timeout quiet-period 2

dot1x timeout tx-period 2

dot1x max-reauth-req 1

spanning-tree portfast

!

Yoy may notice that i have changed the dot1x timeouts. My reason was that dot1x was taking too long to authorize the MAC address and then bring up the port (about 40 -60 seconds) (I am open to correction on this as i was only testing it last week :) ).

By reducing the dot1x timeouts the MAC was authorised and the port was brought up quicker.

I hope this helps

Please rate if it does.

Regards

Stephen

========================== http://www.rconfig.com A free, open source network device configuration management tool, customizable to your needs! - Always vote on an answer if you found it helpful
New Member

Re: Control access to LAN via Radius

Hi,

I don't want the PC/laptop to prompt for username and password

Only MAC address authentication without enter any username and password

Can I dod this via Mac authentication bypass feature ?

Regards

Mohamed

Re: Control access to LAN via Radius

Of Course :)

The MAC-Auth-Bypass will not prompt for username and password. The auth process is completely transparent to the end user. However, there is one thing to remember, If dot1x is enabled on the client i.e. Windows XP dot1x, then xp will try to authorize against dot1x and it will look for a certificate also. You must turn off dot1x on your client PCs for this to work properly..... no problem though :)

Regards

Stephen

========================== http://www.rconfig.com A free, open source network device configuration management tool, customizable to your needs! - Always vote on an answer if you found it helpful
240
Views
0
Helpful
5
Replies
CreatePlease to create content