MAC Based vlan allocation with procurve switches (11x)

[AlexB]

Well I have some HP Procurves, 2626s mainly. I also have 2 cisco 2948Gs.

 

With the ciscos I setup a tftp server, created a vlan mac pairing file, set one of the switches to read the file and be a server for VMPS. Set both ciscos to be clients of the server cisco, set the ports I wanted to by dynamic and quite disturbingly it all worked. I connect and client with a known MAC and it gets the correct vlan... happy me

 

So I now move on to the procurves (I did these second for a reason!)

 

I know they can do mac-based authenication against a RADIUS server and a RADIUS server can return the vlan the client should have. I know this CAN be done, but I haven't the foggest how!

 

I have the a procurve set with one port to use mac-based port-access. I have the radius set with the correct IP and secret key for a newly created IAS RADIUS server on one of my domain controllers. When I also set an auth-vlan and an unauth-vlan I can get the switch to fail to auth and dump the client on to the unauth-vlan. What I cannot do is get the procurve to successfully auth against the RADIUS server (nothing shows in IAS logs, it hasn't even created any!)

 

So what I am looking for (cause I think I have the procurve setup rightish) is how to configure an IAS RADIUS server to work with my procurves.

 

Oh yes, I have a user in the AD with the username and password set to the mac (no formatting and procurve is set to send a no formatted mac) password is reverseable and dialup set to allow.

 

Anyway... please help, I have been able to find a complete guide on the net and have only pickup up snippets here and there.

 

Oh yeah, after I get auth working, I still have no clue how to get the RADIUS server to respond with the right vlan...

 

Thanks in advance!

[AlexB]

Oh yeah, looking at you DMcCoy, you seem like you might know

[AlexB]

Okay, so I've found out how to get IAS to send the vlan ID back to the procurve, now if I could just get them to talk to eachother in the first place!

[DMcCoy]

I did the mac-based authentication for our Apple machines. You are most of the way there. The vlan can be returned by IAS from the policy, the policy can be matched by adding the machine users to a group.

 

1) The switch must exist as a client on IAS

2) The switches default_vlan (which ever one you set) needs to be able to see the IAS server.

3) You need to set an access policy

 

Note, you have to enable reversible encryption *then* set the password.

 

1) Create a RADIUS client in IAS. You need to give it a name, enter the IP of the switch and set a key for the switch to authenticate with. You can't tick the message authenticator box with mac based auth, you can for 802.1x

 

2) assuming your switch has an ip that can see the IAS server.

 

Here is a relevant bit of my config

 

aaa authentication port-access eap-radius

radius-server host 10.0.0.100 key keygoeshere

aaa port-access mac-based 1-23

aaa port-access mac-based 1 unauth-vid 80

aaa port-access mac-based 2 unauth-vid 80

aaa port-access mac-based 3 unauth-vid 80

aaa port-access mac-based 4 unauth-vid 80

aaa port-access mac-based 5 unauth-vid 80

aaa port-access mac-based 6 unauth-vid 80

aaa port-access mac-based 7 unauth-vid 80

aaa port-access mac-based 8 unauth-vid 80

aaa port-access mac-based 9 unauth-vid 80

aaa port-access mac-based 10 unauth-vid 80

aaa port-access mac-based 11 unauth-vid 80

aaa port-access mac-based 12 unauth-vid 80

aaa port-access mac-based 13 unauth-vid 80

aaa port-access mac-based 14 unauth-vid 80

aaa port-access mac-based 15 unauth-vid 80

aaa port-access mac-based 16 unauth-vid 80

aaa port-access mac-based 17 unauth-vid 80

aaa port-access mac-based 18 unauth-vid 80

aaa port-access mac-based 19 unauth-vid 80

aaa port-access mac-based 20 unauth-vid 80

aaa port-access mac-based 21 unauth-vid 80

aaa port-access mac-based 22 unauth-vid 80

aaa port-access mac-based 23 unauth-vid 80

aaa port-access mac-based addr-format multi-dash

 

 

 

This should start getting messages on the IAS server.

 

3) Create a remote access policy in IAS

 

I'll attach some screen shots in a minute

[spc-rocket]

Hi Alex,

 

In order for the radius server to send the vlan id, configure the following options:

 

Tunnel-Type = VLAN,

Tunnel-Medium-Type = IEEE-802,

Tunnel-Private-Group-Id = the VLAN ID or name i.e. 20 or Server-VLAN

 

In order to the switches to talk to one another you need to configure trunk links with 802.1q encapsulation.

 

HTH,

 

Ash.

[DMcCoy]

The policy should use EAP method of MD5 challenge and you need to enable the CHAP authentication on it.

 

I also use the NAS-IP-Address matches option in the policy settings, as well as groups.

[AlexB]

nm, I found it. Cause mac-based only use CHAP you have to untick Client must always send the sigature attribute

[AlexB]

Thanks for that folks, I had missed a bit even though it seemed to work, anyway, it all looks good now and I'm a happy camper

[Ric_]

Perhaps somebody could wiki-fy all this

[localzuk]

Just a quick question on this...

 

Should the IAS server be in the same VLAN as the switches (ie. VLAN 1) and if so, should this be done via static VLAN to its port?

[DMcCoy]

Yes, static is a must. Otherwise what happens if it has to unlock its own port?

 

Mine Works like this:

 

Core Switch

VLAN 1 (Managment) (IP 10.0.0.1)

|

| Tagged Uplink

|

Client Switch (VLAN1) (IP 10.0.0.2)

 

The IAS server has a NIC on VLAN1. All requests are sent directly from each switch to the IAS server.

 

Only the switches need access to VLAN1 (and something to manage them with, along with IAS)

 

Edit: Remember that the IAS server needs a NIC that can see the domain too!

[localzuk]

Could that extra NIC not just be a membership to more than one VLAN on its port?

[DMcCoy]

You can if you want

[dpsguard]

Hi All,

 

I want to do Mac address authentication for some printers and few other devices on Procurve 2600 switch, with Radius IAS. I have a couple of questions and will really appreciate guidance on this.

 

1. I understand that I need to create a separate group in AD to include the mac authentication user accounts with accounts having username and password to be same and clear password complexity unders ecurity policy for this so that I will be allowed to have password to be same as username. Can this security policy relaxation for password be only applied to this mac authentication group?

 

2. When the switch will forward the username and password to be the mac address to the IAS and IAS will then relay it to AD for validation, AD will expect supply of a domain name as well. How does the domain name gets appended to the mac authentication credentials sent by switch to the IAS?

 

3. Since I am not doing mac authentication for user window machines, I believe the accounts do not need to be stored with reversible MD5 encryption. Please clarify this as well.

 

Thanks a lot.

[localzuk]

1. Not in windows 2003 server - security policies are domain wide. You'd need a seperate domain, and therefore a second security policy. However, you can do this in a single domain with windows 2008 server.

 

2. I'm not sure on this. We only have a single domain, so it all just works.

 

3. No, reversible authentication is required for windows machines too.

[DMcCoy]

IAS matches DOMAIN\macaddress, the switch just sends the MAC as username and password and IAS does the rest.

 

For 3, if the machines are not going to have their ports authenticated then you won't need to do anything, or enable reversable encryption for them.

[dpsguard]

Really appreciate your support and prompt response.

 

1. Too bad that Windows 2003 server will not allow this and then the only option is to either disable the password complexity globally or to forget about radius based mac authentication and then simply user port security commands to add these mac addresses to respective switch port. The only problem then is that we can not move these devices to other than assigned ports. The other solution that can be explored is to use a second radius server ( Linux FreeRADIUS) that will have these mac address accounts created and service these devices, but I have to figure out if Procurve switch will allow to take two RADIUS servers for the purpose of authenticating requests coming in from two separate set of ports. I know we can specify even 4 radius servers, but they are all for failover.

 

2. So you mean, AD will authenticate a user ( a printer in this case with its mac address being passed on to IAS by switch as both username and password) even if it presents only username / password and no domain name?

 

3. I think I could not explain this better. I meant to ask if mac address accounts that I will create in AD, will these be required to be stored as hashed MD5 as there is an option to check or uncheck this on user accounts while creating passwords.

 

Please advise.

 

Thanks again.

[localzuk]

Really appreciate your support and prompt response.

 

1. Too bad that Windows 2003 server will not allow this and then the only option is to either disable the password complexity globally or to forget about radius based mac authentication and then simply user port security commands to add these mac addresses to respective switch port. The only problem then is that we can not move these devices to other than assigned ports. The other solution that can be explored is to use a second radius server ( Linux FreeRADIUS) that will have these mac address accounts created and service these devices, but I have to figure out if Procurve switch will allow to take two RADIUS servers for the purpose of authenticating requests coming in from two separate set of ports. I know we can specify even 4 radius servers, but they are all for failover.

 

What about having a seperate domain for the Mac authentication - there's nothing saying it has to be a part of your existing domain. If you did this, you could have a different security policy.

 

2. So you mean, AD will authenticate a user ( a printer in this case with its mac address being passed on to IAS by switch as both username and password) even if it presents only username / password and no domain name?

 

From what DMcCoy seems to say, it appears to use the domain name of the IAS machine as the domain of the devices. Which would make sense.

 

3. I think I could not explain this better. I meant to ask if mac address accounts that I will create in AD, will these be required to be stored as hashed MD5 as there is an option to check or uncheck this on user accounts while creating passwords.

 

Yes, they need reversible authentication on the MAC address accounts for all devices that will authenticate via IAS.

[dpsguard]

Thanks DMcCoy. I just read your reply after I wrote this. I understand now that IAS append the domain name (being enrolled on domain) while forwarding username / password as AD will definately like to see domain name coming in else it will simply reject it.

 

I am still not clear about my question #3. I believe this is only required if MD5 option is selected under 802.1x instead of PEAP option as in case of MD5 802.1x, the comparison has to be made between one way hashed password. But in my case, I am not using 802.1x anyway for mac authentication.

 

Appreciate again and look forward to more feedback on this.

[dpsguard]

Thanks Localzuk. It is making sense to me. I am a network guy and not windows admin, so I have very limited knowledge on window NOS side.

 

I believe on an existing W2k3 domain controller, we can certainly add another domain for mac address users ( and have two way trust between these two domains), but then how does the IAS talk to two domains on the DC? IAS will be enrolled / registered with only main domain and thus forward requests only to main domain. I guess then DC has to somehow pass on the credentials to the second domain database, but then it will fail as seocnd domain database will see domain name appended to credentials being the main domain name.

 

Just as a curiosity, is there a way to add local user accounts (in this case mac accounts) to switch and then use local authentication?

 

Please advise.

 

Thanks

[DMcCoy]

The HPs can use local authentication I believe, although I have never configured it.

 

All IAS needs is a group or user that matches one of it's policies. You could have a domain just for MAC based auth with the only users being those that are needed for the MAC based authentication. IAS does not need to be on the same domain as anything else if you don't want it to. All that it needs is to be connected to the domain that holds the MAC user accounts.

 

You can turn on reversible encryption for just those accounts, its on the account options page, the users don't even need to be members of the domain users group, just the group that matches the IAS policy.

 

You don't need a trust between the domain either if IAS is a member of a seperate one for the authentication.

 

For something like 802.1x with windows machine accounts, then you also don't need reversible encryption for the machine or user accounts, it's only needed for the MAC port authentication.

[localzuk]

Thanks Localzuk. It is making sense to me. I am a network guy and not windows admin, so I have very limited knowledge on window NOS side.

 

I believe on an existing W2k3 domain controller, we can certainly add another domain for mac address users ( and have two way trust between these two domains), but then how does the IAS talk to two domains on the DC? IAS will be enrolled / registered with only main domain and thus forward requests only to main domain. I guess then DC has to somehow pass on the credentials to the second domain database, but then it will fail as seocnd domain database will see domain name appended to credentials being the main domain name.

 

Why would your IAS box be linked to the main domain? Is it doing something else also?

 

Just as a curiosity, is there a way to add local user accounts (in this case mac accounts) to switch and then use local authentication?

 

I don't know, i've never really looked at it, as it would be unsustainable with anything more than a couple of switches and a couple of computers.

[DMcCoy]

Why would your IAS box be linked to the main domain? Is it doing something else also?

 

Mine is due to 802.1x/Wifi using machine/normal user accounts.

[dpsguard]

Yes, I will also need to use the same IAS Radius for 802.1x for users and mac authen for printers and other machines which are not capable of running 802.1x. The users will then be in main domain and mac authen devices will be another domain. So IAS will need to talk to two domains, unless there is a way to not disable password complexity policy on AD globally.

 

That is why I was considering two more options, one having port security ( have only 4 edge switches and there can be ports set aside on each for printers etc that are mobile and add limited such printers be addded to all such edge switches) and the second one to simply have a FreeRadius based Radius only for mac authentication with such devices put into a separate VLAN / set of ports, but need to figure out how these ports will use only FreeRadius and not be directed to IAS.

 

Thanks

[dpsguard]

Folks,

 

Looks like we have a solution to use two Radius servers, one for 802.1x and second for mac authen.

 

The trick will be to configure two Radius servers in switches on two different subnets / VLANs and then on the upstream Distribution / Core L3 switch, add ACL to each VLAN denying access to the other radius server IP address.

 

If someone can lab this up, that will be great as it will take me a while to get all this together.

 

Thanks