Config for 802.1x use on network switches
Hello, We would like to enforce authentication for all clients connecting to our network (wired or wireless), so that when a client connects, the client will not be able to use the network unless it successfully authenticates (e.g. via web) with a valid account (LDAP-based). We have a network based mainly on Cisco 2950/2960 switches. We are running a central LDAP Server (openldap) where we hold user accounts, which are used for mail, ftp, web, Shibboleth access. I guess we can enable 802.1x on switches and require authentication of clients over freeradius. Is there a suggested sample freeradius configuration for such use? Can you please provide one or point me to a URL for it? Can you share your experience and any pitfalls we should consider? Any experiences on such use? Does this scale well (for about 20-30 switches)? Should we consider a central management solution? (Which?) Thanks in advance, Nick
Am Dienstag, 7. Mai 2013, 14:27:35 schrieb Nikolaos Milas:
Hello,
We would like to enforce authentication for all clients connecting to our network (wired or wireless), so that when a client connects, the client will not be able to use the network unless it successfully authenticates (e.g. via web) with a valid account (LDAP-based).
We have a network based mainly on Cisco 2950/2960 switches.
http://www.cisco.com/en/US/docs/switches/lan/catalyst2950/software/release/1... or search for your switch and IOS version.
We are running a central LDAP Server (openldap) where we hold user accounts, which are used for mail, ftp, web, Shibboleth access.
I guess we can enable 802.1x on switches and require authentication of clients over freeradius.
Is there a suggested sample freeradius configuration for such use? Can you please provide one or point me to a URL for it?
Read the rlm_ldap file in the doc directory. Quite old, but still work: http://vuksan.com/linux/dot1x/802-1x-LDAP.html
Can you share your experience and any pitfalls we should consider?
Pitfalls: - Devices that do not speak 802.1x, i.e. printers. - Devices with more that one MAC address, i.e. laptops with virtual machines. - Devices of users that are not in your LDAP, i.e. consultants, guests. - Devices behind IP phones (two MAC addresses!). Perhaps you need to mess around with guest, resticted, and voice VLAN.
Any experiences on such use? Does this scale well (for about 20-30 switches)? Should we consider a central management solution? (Which?)
LDAP scales well. FreeRADIUS will not have any performace problem. Perhaps you get a lot of work taking care of all the MAC addresses of your non-802.1x devices. A customer of mine has a data base with 120.000 MAC addresses ... -- Mit freundlichen Grüßen, Michael Schwartzkopff -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Axel von der Ohe, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein
On 7/5/2013 2:37 μμ, Michael Schwartzkopff wrote:
Thank you Michael for your valuable feedback, esp. the link above. By the way, I've been pointed to: http://www.packetfence.org for a more integrated system, which also supports 802.1x and it looks nice and clean. It works with freeRadius too. Any experience with it? Any advice? Thanks in advance, Nick
Am Mittwoch, 8. Mai 2013, 12:29:44 schrieb Nikolaos Milas:
On 7/5/2013 2:37 μμ, Michael Schwartzkopff wrote:
Thank you Michael for your valuable feedback, esp. the link above.
By the way, I've been pointed to: http://www.packetfence.org for a more integrated system, which also supports 802.1x and it looks nice and clean.
It works with freeRadius too.
Any experience with it? Any advice?
Thanks in advance, Nick
Depending on your needs it might be a little bit oversized. It seems to integrate everything that someone might ever need. But if you need that functionality you might give it a try. If you only need 802.1x for a handful of switches plain FreeRADIUS with a *SQL database in the backend is perhaps the right choice for you. Greetings, -- Michael Schwartzkopff -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Axel von der Ohe, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein
participants (2)
-
Michael Schwartzkopff -
Nikolaos Milas