802.1x mind map

802.1x mind map

Port based authentication
1. The flow
  1. Device comes up, authenticator sends a EAP request (who are you)
    1. Supplicant will reply with credentials (if supplicant software is installed)
      1. Authenticator will send credentials to authenticaton server using RADIUS, however it can encrypt this using PEAP which in turn uses TLS with an access-request
        Remember TLS implies digital certificates are required
        authentication server will reply with an access-challenge
      2. note that also as part of this process the server will go through negotiations with the supplicant for which eap protocol to use and also if configured and using tls certificates will be exchanged to authenticate the server
    2. chaining
      1. if you want to authenticate a user and a device separately this is called chaining
        if you want to perform chaining the EAP protocol you will need is EAP-Fast
2. modes
  1. single-host
    1. one device, one mac address only on this port
  2. multi-host
    1. one mac address authenticates and then any other mac address can use that port also as long as port stays up
  3. multi-doman (MDA)
    1. One each mode, allows one mac address for data and one mac address for voice
  4. multi-auth
    1. each device needs to authenticate individually, each mac address will need its own supplicant to authenticate
  5. MAB
    1. Mac address bypass, if no supplicant is installed, after a set time the 802.1x will timeout and move to next method, if Mac address is set in ISE then will authenticate with MAC address
configuring
1. on switch (authenticator)
  1. aaa authentication dot1x default group radius
    1. dot1x system-auth-control
      1. int# authentication host-mode [multi-auth]
        int# authentication [open/
        open- for testing, allows all even if failed
        int# dot1x pae authenticator
        tells port that it is the authenticator
        int# authentcation port-control-auto
        tells port to allow dot1x to control access
        to verify its working before leaving open mode use int# show authentication int g0/1 or int# show authentication sessions int g0/1
        radius server attribute 6 on-for-login-auth
        if using MAB, sends mac address to ISE
        INT# MAB
        ALLOWS MAB
        int# authentication order dot1x mab
Methods
1. 802.1X
  1. Periodic re-authentication (disabled by default)
2. MAB
  1. No periodic re-authenticaion
  2. uses RADIUS service type 6
3. how methods are chosen
  1. int# authentication order dot1x mab webauth
    1. dot1x is chosen first, if timesout goes to mab then to webauth
  2. int# authentication priority dot1x mab webauth
    1. first choice is dictated by order, but if switch receives a dot1x request it will switch to dot1x
  3. authentication event fail action next-method/ authorize vlan x
    1. next method goes to next method, should only be used if webauth configured or cycles endlessly, authorize vlan x puts port into vlan x
      1. authentication fallback command needed to enable webauth

Next up

Description

Resource summary

Similar

	Created by John Lodge almost 10 years ago