Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

802.1x MAC authentication

Hi,

I've been searching for the right solution for my problem on an on for the last week on this forum and other sites. I didn't get a clear answer so here I am posting it:

Is it possible to do MAC-based authentication and VLAN assignement with 802.1x against a RADIUS server? _I know_ you will give me the VMPS solution wich I have already taken into consideration, but I will rather do it with 802.1x if it is possible for a number of reasons.

I'm not looking to do port filtering (to allow only one MAC address defined in the switch). The switch should interogate the RADIUS server if the MAC has access and what VLAN should be placed on; all that by means of 802.1x. Can it be done?

Thanx.

Gabi.

7 REPLIES

Re: 802.1x MAC authentication

Yes, the switch will merely pass the 802.1x from the client to the Radius, the bulk of the configuration is done on the server. At the switch it's called "Using 802.1X with VLAN Assignment". Here is a link on a cat4000 on how to configure 802.1X with VLAN assignment:

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat4000/12_2_25a/conf/dot1x.htm#wp1142124

But you can find configuration guid on other platforms through UniverCD:

http://www.cisco.com/univercd/home/home.htm

And here is a link on Using a RADIUS Server to Assign Users to VLANs:

http://www.cisco.com/univercd/cc/td/doc/product/wireless/airo1200/accsspts/b1237ja/i1237sc/s37vlan.htm#wp1038739

New Member

Re: 802.1x MAC authentication

OK, I got that, but is it possible to do the authentication and VLAN assignement _based on the client's MAC address_?. From what I red on the links the authentication is based on user/password.

Re: 802.1x MAC authentication

Missed that you can either try the 802.1X VLAN Assignments Using a RADIUS Server Work with the port security. You may want to check the RADIUS if it can use mac-address for authentication. I think it can but I am not sure.

Re: 802.1x MAC authentication

The latest IOS for 2960, 2970, 3550, 3560 & 3750 - 12.2(25)SEE - has a section about 802.1x Authentication with MAC Authentication Bypass. This was mentioned last year and this is first time I have seen it in any release notes.

http://www.cisco.com/univercd/cc/td/doc/product/lan/c3550/12225see/scg/sw8021x.htm#wp1170569

This is ONLY available in the 12.2(25)SEE release (just tried on a 12.2(25)SED1 3750 and the commands aren't there). 12.2(25)SEE introduces a nice 802.1x/Radius bug though (CSCsd38857) where 802.1x authentication requests send Radius Attribute NAS-Port-Type as 'Virtual' instead of 'Ethernet'. Great if you have Radius Policies based on this attribute.........

I assume this only currently works with ACS though?

HTH

Andy

New Member

Re: 802.1x MAC authentication

It's too bad we have 2950's :) Altough the 12.2(25)SEE could be uploaded to a 2950 (http://www.cisco.com/en/US/products/ps6406/products_configuration_guide_chapter09186a00805a8418.html).

I guess I shuld be heading to VMPS...

Found today a post in a forum of someone using VMPS clients authenticating against a TACACS server. Is that possible??

Here's the link:

http://seclists.org/lists/security-basics/2004/Oct/0229.html

Re: 802.1x MAC authentication

I think the link is regarding replacing a 2950 with a 2960, not uploading 2960 IOS to a 2950........

VMPS is not really a 'forward' technology and 802.1x is really the way to go. The VMPS server can be a URT Server and you can get it to pull user credentials from various databases (Active Directory, LDAP, Radius, TACACS+ etc). The URT server is EOS/EOL so further development of this product is unlikely.

If you want to secure user ports, you can physically secure them to a degree (lock cabinets, cut the tabs of the RJ45's etc). You can also implement port-security with sticky or fixed MAC addresses so users attempting to connect a PC to a port reserved for a printer won't work.

HTH

Andy

New Member

Re: 802.1x MAC authentication

What I'm really trying to do is provide user mobility but not necesarily using LDAP or other 'user/password' method and secure correct VLAN placement. In my vision the best way to provide that would be MAC based VLAN assignement. From what I understood this is only provided in 2960, 2970, 3550 etc...

How would one provide MAC based VLANS on Catalyst 2950?

693
Views
0
Helpful
7
Replies