802.1X authentication with Cisco Switch and IAS

[AJ1982]

Hi,

Ive been reading up on 802.1X authentication and would like to know the following...

Our lab network has a list of "fixed" PC's which we would like to go into one VLAN, sometimes people bring in their own laptops, which we would like to go into another VLAN.

Can we acheive this, and more importantly is there any guide for setting up the ISA server.

Thanks for all your help.

Andrew J

===

Fatman Superstar (Andrew James)

CCNA, CCAI

 

[Parcival21]

Hi there,

I'm at the same point as you at the moment I think.
Generally your plan should be possible. If you are using cisco switches and some kind of radius authentication, the authentication server (in my case probably a radius server) can assign vlan's to different clients:
So the only thing you need to do is to define which user will get into which vlan.

bye,
busche

 

[AJ1982]

Thanks, ive read some stuff that you can only acheive the 802.1x authe with XP, but surely it stems off the MAC from what the switch says, so is there a relevance on the OS?

Cheers for your help. If anyones got guides would be great on config for the IAS.

Cheers

AJ

===

Fatman Superstar (Andrew James)

CCNA, CCAI

 

[Parcival21]

There is a relevance of the OS because in 802.1x authentication the supplicant/client/user is the client of the authentication. For example if you use radius authentication the supplicant is the client and needs an installed radius client. The switch(authenticator) only forwards the messages during authentication. As far as I know 802.1x can be done with XP or with w2K but only with service pack 4. I think there will be support coming/maybe already there for other OS too. Another important thing is that the support of the OS depends on which authentication method like peap/eap-tls... you use.

bye busche

 

[lui3]

i think you can use DHCP snooping option (81? or something) support on cisco switches to locate clients in the appropriate vlan dynamically.

this is how cisco security aware network works.

check out cisco site for dhcp snooping capability

 

[lui3]

dhcp snooping option 82 is what i was thinking of

 

[Parcival21]

does dhcp snooping option have anything to do with 802.1x or is it a total different topic?

Thank's,
busche

 

[lui3]

dhcp snooping uses 802.1x and dynamic vlan assignment to assign users to vlans based on login information. i think. i will get information from cisco and post.

 

[lui3]

My bad. I am thinkgin of something else. Regard the snooping information. Here is what cisco says about basic snooping however.

DHCP snooping is a DHCP security feature that provides security by filtering untrusted DHCP messages and by building and maintaining a DHCP snooping binding table. An untrusted message is a message that is received from outside the network or firewall and that can cause traffic attacks within your network.

The DHCP snooping binding table contains the MAC address, IP address, lease time, binding type, VLAN number, and interface information that corresponds to the local untrusted interfaces of a switch; it does not contain information regarding hosts interconnected with a trusted interface. An untrusted interface is an interface that is configured to receive messages from outside the network or firewall. A trusted interface is an interface that is configured to receive only messages from within the network.

DHCP snooping acts like a firewall between untrusted hosts and DHCP servers. It also gives you a way to differentiate between untrusted interfaces connected to the end-user and trusted interfaces connected to the DHCP server or another switch.


--------------------------------------------------------------------------------
Note In order to enable DHCP snooping on a VLAN, you must enable DHCP snooping on the switch.

--------------------------------------------------------------------------------

You can configure DHCP snooping for switches and VLANs. When you enable DHCP snooping on a switch, the interface acts as a Layer 2 bridge, intercepting and safeguarding DHCP messages going to a Layer 2 VLAN. When you enable DHCP snooping on a VLAN, the switch acts as a Layer 2 bridge within a VLAN domain.

 

[Parcival21]

Thx for the information lui3.
So let me try if I understood this right.
DHCP snooping is something you can assign to a special VLAN that has already been assigned to a so called "untrusted" port to prevent your network from attacks through this port...

 

[lui3]

i believe it is a rogue DHCP server attack mitigation technique. i have seen other uses for it as well. hence my comment on option 82. option 82 is used by ISP to keep too many hosts on a hub or network from getting too many ip addresses.