We did mac-based authentication on our campus resnet with about 5000 unique MAC addresses. We have dominantly foundry, and some cisco 3550s. Foundry switches work very good. Their dot1x feature sets are very good, they called multi-device port authentication. Cisco 3550 is ok, at lease we get the MAB working as we architected. You have to disable 802.1x in order to do MAB. There are some catches though. Sample cisco switch configuration aaa new-model aaa authentication dot1x default group radius aaa authorization network default group radius local dot1x system-auth-control interface FastEthernet0/3 description MAC-AuthC switchport access vlan 552 switchport mode access dot1x mac-auth-bypass dot1x critical dot1x pae authenticator dot1x port-control auto dot1x host-mode multi-host dot1x timeout tx-period 1 dot1x max-reauth-req 1 spanning-tree portfast spanning-tree bpduguard enable radius vlan instruction policy settings $RAD_REPLY{'Service-Type'} = "Framed-User"; $RAD_REPLY{'Tunnel-Type'} = "VLAN"; $RAD_REPLY{'Tunnel-Medium-Type'} = "IEEE-802"; $RAD_REPLY{'Tunnel-Private-Group-Id'} = "YourVLANName"; There is one special troubleshooting guide for MAC address authentication, please make sure student computer does not have 802.1x authentication enabled on Ethernet network connection when student call and say the network report no or limited network connection. We found out that Windows XP and Windows Vista 802.1x authentication is not enabled by default, but we just want to double check to make sure the 802.1x authentication is disabled on Ethernet connection. How to check the 802.1x authentication is off? In windows XP, Start, Settings, Network Connections, right click Local Area Connection, select Properties, If you does not see an Authentication tab, 802.1x is not available thus not enabled. If the Authentication tab is available, please make sure "Enable IEEE 802.1x for this network" checkbox is not checked. More technical details regarding Windows 802.1x authentication for your information. In windows XP SP3 and Windows Vista, there is a service which is set to Manual and Stopped by default start->run->cmd services.msc service: dot2svc display name: wired autoconfig description: This service performs IEEE 802.1X authentication on Ethernet interfaces If you click right click the service and start the service, the Authentication tab will show up in your local area connection properties. Schilling On Wed, Nov 26, 2008 at 8:42 AM, <tnt@kalik.net> wrote:
Do they support Mac-Based Auth + 802.1X on the same port?
In a (very) weird way. It's not mac auth + 802.1x but mac auth *in* 802.1x (mac address is sent as user/pass - requires registry hacking on XP). And then you can re-authenticate with username/pass.
There is also something called mac authentication bypass for 802.1x. If enabled switch will do mac auth if it doesn't get EAPOL packet from the supplicant. So, in a matter of speaking, you can have mac auth and (probably should say or - the idea is to be able to connect something that doesn't do 802.1x, like a network printer) 802.1x on the same port.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html