Implementing 802.1x on a wired network 1

[RookThis]

Has anyone tried implementing 802.1x on a wired network? I'm trying to determine how devices that do not have machine certificates are supported in this environment, such as printers. I've thought that enabling port security but that will require a lot of adminisistration. Does anyone have any information pertaining to this?

Thanks!

 

[ADB100]

For devices that simply don't have an 802.1x supplicant then the options are to use Guest VLAN's, disable 802.1x on the particular port or a 3rd new option from Cisco based on mac-based proxy-802.1x. This works by waiting for the switchport to timeout the dot1x EAPOL polls (can be tuned) and then sends a proxy-dot1x authentication request to the RADIUS server using the clients MAC address. I don't know any more than that but I presume it only works with Cisco ACS (and probably the very latest version at that).

Port securtiy can be enabled with 'Sticky' MAC addresses so you don't have to manually enter all the MAC addresses. Still a bit of a pain to administer though if clients do move around.

HTH

Andy

 

[RookThis]

Thx Andy for the information... Do you know if there is any info on the mac-proxy feature? I'll take a look on CCO, but it looks like you have more insight to this than I do.

I appreciate the help! Thanks again!

 

[ADB100]

It has only appeared in the latest IOS release notes - 12.1(22)EA7 for Catalyst 2950 and 12.2(25)SEE for 2960,2970,3550,3560 and 3750. Cisco have apparently 'harmonised' the 802.1x code on all platforms (at least with the 12.2(25)SEE they have, although they introduced a BIG 802.1x Radius bug as well.....).

I remember getting a partner email last year about the Proxy-MAC authentication but then never heard anything more until these release notes.

HTH

Andy

 

[RookThis]

Thanks again!

 

[RookThis]

Andy, do you have the link for the release notes? I've looked on CCO at the release notes for the images that you denoted, and I can't find that information. Can you assist me with this please.

Thanks

 

[ADB100]

The bug isn't listed (CSCsd38857) in the release notes but you can find it on the bug navigator.
The documentation for this feature in 12.2(25)SEE for the 3550 are at:

http://www.cisco.com/univercd/cc/td/doc/product/lan/c3550/12225see/scg/sw8021x.htm

HTH

Andy

 

[RookThis]

Thanks again Andy...