802.1X on wired ports?

[FN-GM]

Hello,

 

I was wondering if anyone uses 802.1X / Radius authentication on wired ports?

 

How was your experience?

 

Thanks.

[chazzy2501]

oooh me too. probably need a radius server and a cert serve though (both unknown to me)

[FN-GM]

oooh me too. probably need a radius server and a cert serve though (both unknown to me)

 

We use it for VPN and WIFI so not too much of an issue for us.

[CHiLL]

When we had our network replaced in 2015, the contractor implemented 802.1x for both wired and wireless clients, based on machine domain group membership. The WiFi is still 802.1x, however we had to disable it for the wired clients. It technically worked fine, but there were issues with Impero. I can't remember exactly, but it either wouldn't broadcast across multiple VLANs or wake-on-LAN wasn't working. It's remained disabled ever since. I've wanted to try it again, though I'm reluctant to change settings as the system works the way it is and I don't want to risk borking that! Edited October 23, 2020 by CHiLL

[FN-GM]

When we had our network replaced in 2015, the contractor implemented 802.1x for both wired and wireless clients, based on machine domain group membership. The WiFi is still 802.1x, however we had to disable it for the wired clients. It technically worked fine, but there were issues with Impero. I can't remember exactly, but it either wouldn't broadcast across multiple VLANs or wake-on-LAN wasn't working. It's remained disabled ever since. I've wanted to try it again, though I'm reluctant to change settings as the system works the way it is and I don't want to risk borking that!

 

It will probably be the WOL.

 

You can configure the switches to allow certain traffic when not authenticated. This will allow your WOL to work.

[MatthewL]

We have looked at it with Packet Fence, integrates with our WiFi. We will be implementing it again and everything if not on the domain will just drop into our internet only guest VLAN. A number of our buildings are shared sites too with common shared network cabinets so stuff often gets patched into wrong networks by the others.

[Mustang]

We have been running a small pilot of about 40pcs and 60Macs for about 2 years but never got chance to expand on it. Haven't had a single issue with it but we don't use WOL

All the machines are dumped in an unauthorised vlan but once the OS starts and they authenticate they moved into the normal data vlan.

 

Biggest issued we faced were

• Our IP phones only support Mac authentication and the radius server doesn't, it can also only put devices in an untagged vlan, so the phones ended up in the data vlan with no QOS. You also need to tell the switch that multiple device can be connected to a port if the phone has a pass through port.
   
  
• Windows Depoyment with MDT, you need your pxe server, DNS available on the unauthorised vlan. you have to build a custom pe with 802.1x support and a custom script that authenticates the PE. Once that has happened you can deploy your OS/image to the machine but when the machine reboots you will need another script that runs during the OOBE to authenticate again so you can carry on the deployment and access the MDT share.
   
  
• HP Printers, never bothered as it looked a right mess and they are already on a restrictive vlan.
   
  

 

 

We also currently use peap authentication which means you can't run credential guard and other newer security features on windows 10, so the plan is to swap it to eap-tls before we update to 20H2