Am Dienstag, 7. Mai 2013, 14:27:35 schrieb Nikolaos Milas:
Hello,
We would like to enforce authentication for all clients connecting to our network (wired or wireless), so that when a client connects, the client will not be able to use the network unless it successfully authenticates (e.g. via web) with a valid account (LDAP-based).
We have a network based mainly on Cisco 2950/2960 switches.
http://www.cisco.com/en/US/docs/switches/lan/catalyst2950/software/release/1... or search for your switch and IOS version.
We are running a central LDAP Server (openldap) where we hold user accounts, which are used for mail, ftp, web, Shibboleth access.
I guess we can enable 802.1x on switches and require authentication of clients over freeradius.
Is there a suggested sample freeradius configuration for such use? Can you please provide one or point me to a URL for it?
Read the rlm_ldap file in the doc directory. Quite old, but still work: http://vuksan.com/linux/dot1x/802-1x-LDAP.html
Can you share your experience and any pitfalls we should consider?
Pitfalls: - Devices that do not speak 802.1x, i.e. printers. - Devices with more that one MAC address, i.e. laptops with virtual machines. - Devices of users that are not in your LDAP, i.e. consultants, guests. - Devices behind IP phones (two MAC addresses!). Perhaps you need to mess around with guest, resticted, and voice VLAN.
Any experiences on such use? Does this scale well (for about 20-30 switches)? Should we consider a central management solution? (Which?)
LDAP scales well. FreeRADIUS will not have any performace problem. Perhaps you get a lot of work taking care of all the MAC addresses of your non-802.1x devices. A customer of mine has a data base with 120.000 MAC addresses ... -- Mit freundlichen Grüßen, Michael Schwartzkopff -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Axel von der Ohe, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein