MAC-Auth has its place, but I agree with
some others this isn’t the best fit. MAC spoofing = easy. User gets new NIC
or computer = often.
“You” don’t need to do anything on the
client. How about you set a default VLAN with restrictions, a captive portal
of sorts. They don’t need to “login”,
but every DNS request lands them on a page that says: You’re not authenticated;
you need to follow the directions in this link. Have a how-to with pretty
pictures and stuff, I’m sure there are many already on the web. ACL on the
default “GUEST” VLAN restricts their IP access as you see fit.
Bottom line, users can enable / configure
802.1x supplicant themselves with a little guidance. In the long run you’ll be
WAY better off with 802.1x. IMHO.
G
From:
freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org
[mailto:freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org] On Behalf Of Paulo Maia
Sent: Thursday, July 07, 2011 4:10
PM
To:
Subject: Re: Mac-Auth
I dont want to enable
802.1x auth in the clients coz i have over 3000 computers and i dont have AD to
set a gpo to set in all clients .... But i do have all
mac-addresses . I dont know if im going the wrong way here .
Thanks ,
On Thu, Jul 7, 2011 at 5:59 PM, Paulo Maia <phc.maia@gmail.com> wrote:
Ok guys thanks .
One other question tough .... i have configured radius settings in the
switch (c2960g) with aaa-newmodel dot1x port-control auto and the requests are
getting to the radius server OK . But it keeps asking for user/pass auth and .
Is there a way to authenticate the mac-address without enable 802.1x in the
client computer ?
On Thu, Jul 7, 2011 at 4:19 PM, Alan Buxey <A.L.M.Buxey@lboro.ac.uk>
wrote:
Hi,
> Hi Guys
,
> Here is the thing , im trying to use Mac-Auth , I managed to
get working
> using authorized-macs files , although i need to use a mysql
table� witch
> i already have with the ssid and mac-address fields and i
need to add an
> operator to expired macs , coz i work at a college campus and
students
> mac-addresses need to expire acording to their course period
. Any ideas ?
> Thanks in advance .
put MAC address in the radcheck table and set an Expiration. should
work a treat
00-11-22-33-44-55 Expiration := "10 Jul 2011"
alan
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html