Wired 802.1x auth - Getting the IP address of the authed machine
I have a wired 802.1x auth setup on cisco gear. I would like to record the IP address of machines that connect and are authorized. Is this possible? I currently see NAS-IP-Address and Client-IP-Address as the IP of the switch. The Calling-Station-Id is the correct mac address of the authorized machine. The machines that are connecting to be authed are allocated their address using dhcp. Cheers Paul
I have a wired 802.1x auth setup on cisco gear. I would like to record the IP address of machines that connect and are authorized. Is this possible?
I currently see NAS-IP-Address and Client-IP-Address as the IP of the switch. The Calling-Station-Id is the correct mac address of the authorized machine. The machines that are connecting to be authed are allocated their address using dhcp.
You will need to get accounting packets for that. Ivan Kalik Kalik Informatika ISP
I have accounting turned on, but I don't see the authed machines IP on that of the NAS. On Wed, Feb 25, 2009 at 8:47 PM, <tnt@kalik.net> wrote:
I have a wired 802.1x auth setup on cisco gear. I would like to record the IP address of machines that connect and are authorized. Is this possible?
I currently see NAS-IP-Address and Client-IP-Address as the IP of the switch. The Calling-Station-Id is the correct mac address of the authorized machine. The machines that are connecting to be authed are allocated their address using dhcp.
You will need to get accounting packets for that.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Paul Dealy wrote:
I have accounting turned on, but I don't see the authed machines IP on that of the NAS.
This is an advanced vendor specific feature. The switch will need to be running some form of DHCP snooping, or layer 3 header inspection. I know Trapeze wireless controllers support this (where the IP address of the client is inserted into the Framed-IP-Address attribute of accounting packets), but I have no idea about Cisco kit. Regards, Arran - -- Arran Cudbard-Bell (A.Cudbard-Bell@sussex.ac.uk), Authentication, Authorisation and Accounting Officer, Infrastructure Services (IT Services), E1-1-08, Engineering 1, University Of Sussex, Brighton, BN1 9QT DDI+FAX: +44 1273 873900 | INT: 3900 GPG: 86FF A285 1AA1 EE40 D228 7C2E 71A9 25BB 1E68 54A2 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkmlKzIACgkQcaklux5oVKILFQCfZY8WCrbwK118B8ISz/2ALfHv VYAAoItOLHBnegsFdb7goejDmTsMTmC0 =C5Zl -----END PGP SIGNATURE-----
* Paul Dealy <pdealy@gmail.com> [Wed, 25 Feb 2009 21:42:37 +1100]:
I have accounting turned on, but I don't see the authed machines IP on that of the NAS.
Use DHCP Snooping[1] and then yank the DHCP servers logs. If you want them in the SQL table, you should add them afterwards. You need to bear in mind that in the medium-long term there will be nothing stopping (or invalid) about computers having multiple IP addresses[2]. Expecting a venduh (especially Cisco) to give you what you want/need is asking for trouble. We personally yank from our DHCP logs, because of DHCP snooping, we know they can be trusted. Cheers [1] http://www.cisco.com/web/DK/assets/docs/security2006/Security2006_Eric_Vynck... [2] IPv4 and IPv6 addresses, multiple of the later for workstations is an expectation not an edge case. Also there is technically nothing stopping a workstation in a single 'session' changing IP addresses -- Alexander Clouter .sigmonster says: Go on, EMOTE! I was RAISED on thought balloons!!
participants (4)
-
Alexander Clouter -
Arran Cudbard-Bell -
Paul Dealy -
tnt＠kalik.net