pantscat Posted April 20, 2012 Posted April 20, 2012 I would like to setup 802.1x authentication for my wired HP Procurve network (I've already got it up and running on my wireless network). I've got an HP Procurve LAN and use NPS on 2008R2 to do the RADIUS side of things. It uses machine-based AD authentication (e.g. checks that the machine is a member of the domain before authenticating it) I know how to setup bog-standard 802.1x machine authentication for wired connections but my brain is starting to hurt when I think about these things: 1. How do I deal with non-802.1x compliant devices (such as printers, VoIP phones... etc.)? It would be nice if NPS could do AD-authentication or Mac-address authentication to cater for this. What do other people do? 2. I'm doing a VoIP roll-out over the summer... can I setup my HP network to authenticate two devices on one port? e.g. the VoIP phone would need to be mac-address authenticated, but if a PC is plugged into the onboard switch could that then be authenticated using AD-authentication? 2a. ...and would each device be put into a separate VLAN? 3. FOG server... obviously I'll still need to allow PXE booting for FOG devices. I'm guessing that I could probably do this with an unauthenticated VLAN and put an ACL in place to allow VLAN routing to my FOG server. Has anyone done this? Thanks in advance to any replies, Ant
Geoff Posted April 20, 2012 Posted April 20, 2012 1. You either whitelist them (in the example of printers), or have them dumped into a seperate VLAN (perhaps the best idea for your VOIP), or isolate them. 2. VoIP phones should be 801.2Q aware. This should solve the issue for you. 3. This is related to 1. If you sort point 1 out then this should fall into place as well.
DMcCoy Posted April 20, 2012 Posted April 20, 2012 (edited) I would like to setup 802.1x authentication for my wired HP Procurve network (I've already got it up and running on my wireless network). I've got an HP Procurve LAN and use NPS on 2008R2 to do the RADIUS side of things. It uses machine-based AD authentication (e.g. checks that the machine is a member of the domain before authenticating it) I know how to setup bog-standard 802.1x machine authentication for wired connections but my brain is starting to hurt when I think about these things: 1. How do I deal with non-802.1x compliant devices (such as printers, VoIP phones... etc.)? It would be nice if NPS could do AD-authentication or Mac-address authentication to cater for this. What do other people do? 2. I'm doing a VoIP roll-out over the summer... can I setup my HP network to authenticate two devices on one port? e.g. the VoIP phone would need to be mac-address authenticated, but if a PC is plugged into the onboard switch could that then be authenticated using AD-authentication? 2a. ...and would each device be put into a separate VLAN? 3. FOG server... obviously I'll still need to allow PXE booting for FOG devices. I'm guessing that I could probably do this with an unauthenticated VLAN and put an ACL in place to allow VLAN routing to my FOG server. Has anyone done this? Thanks in advance to any replies, Ant I did this a few years ago, lets say it's a lot less painful with Vista/7 than XP as the logon process waits for authentication now. I also returned dynamic VLAN for the machine based on AD group For printers etc I switched the ports to MAC auth, you can do it with NPS, but need to put a registry key back for MD5 auth. The Microsoft Extensible Authentication Protocol-Message Digest 5 (EAP-MD5) implementation is being deprecated from versions of Windows Use dashed format MAC, create user accounts with the MAC (LOWERCASE!), enable reversable encryption for that user, set password to the MAC. You can change the number of devices allowed on an authenticated port, but this can get a little complicated due to needing the same auth type and vlan (you can only return *one* untagged vlan with the HP/NPS combo). FOG/Ghost/WDS is a lot easier with 802.1x and unauth vlan as you can put the server in that vlan. It can be a long process with a lot of testing, but it is worth the effort, machine based dynamic vlans and vlan acls are very useful. Edited April 20, 2012 by DMcCoy 1
pantscat Posted April 20, 2012 Author Posted April 20, 2012 @DMcCoy Thanks for this - good advice. How did you do the dynamic VLANs? Was this with NPS? For the printers do you need to change the config on the switch ports? Seems that the VoIP side of things might be a tad trickier... I'll have to have a think about that if only one auth type can be used. Hadn't thought of sticking the FOG server in the unauth VLAN - that's nice and straight-forward.
DMcCoy Posted April 20, 2012 Posted April 20, 2012 You can return a vlan to the switch with NPS, I had all 802.1x and MAC auth ports default to untagged in the unauthenticated vlan, the authentication then returned the vlan to the switch on auth (this becomes the untagged vlan, other vlans may not work, even when tagged). It's easier to use computer auth for this, but you can do user based if required (more painful though). The printer ports were changed to MAC auth on the switch, although some now support 802.1x. For apples, they now have better 802.1x support, but I was using then on MAC based at the time. I had limited access for unauthenticated machines, access to the DCs for group policy, dns, time and to join the domain.
pantscat Posted April 20, 2012 Author Posted April 20, 2012 How do you configure the switches to get the dynamic VLAN from NPS? That does sound cool! For the printers did you just have a list of allowed MAC addresses configured on the switch?
DMcCoy Posted April 20, 2012 Posted April 20, 2012 On NPS you can return VLAN in the auth reply, for both 802.1x and MAC. This is then used by the switch while the port is authenticated. MAC auth ports for printers just had users created in AD with the right group membership for the device MAC, the switch still sends the request to the radius server, it's why you need to enable md5-chap auth to use it. 1
pantscat Posted April 23, 2012 Author Posted April 23, 2012 @DMcCoy What ACLs do you use to allow the guest VLAN to access your DCs for Group Policy and to join the domain? Thanks for your help btw, I've got the dynamic VLANs working beautifully!
DMcCoy Posted April 23, 2012 Posted April 23, 2012 @DMcCoy What ACLs do you use to allow the guest VLAN to access your DCs for Group Policy and to join the domain? Thanks for your help btw, I've got the dynamic VLANs working beautifully! These are ACLs I was using, two DCs 10.0.7.1 and 10.0.7.2, the guest range was 10.0.8.x. You need the ping response for GPO iirc, I allowed file access so that the GPOs could be downloaded by the joined clients if they failed auth (802.1x policy was defined in it!) DCs have RPC set to the ranges 49152-50152 ip access-list extended "GuestI" 10 permit udp 10.0.8.0 0.0.0.255 10.0.7.1 0.0.0.0 eq 68 20 permit udp 10.0.8.0 0.0.0.255 10.0.7.1 0.0.0.0 eq 53 30 permit tcp 10.0.8.0 0.0.0.255 10.0.7.1 0.0.0.0 eq 53 40 permit tcp 10.0.8.0 0.0.0.255 10.0.7.1 0.0.0.0 eq 88 50 permit udp 10.0.8.0 0.0.0.255 10.0.7.1 0.0.0.0 eq 88 60 permit tcp 10.0.8.0 0.0.0.255 10.0.7.1 0.0.0.0 eq 123 70 permit tcp 10.0.8.0 0.0.0.255 10.0.7.1 0.0.0.0 range 135 139 80 permit udp 10.0.8.0 0.0.0.255 10.0.7.1 0.0.0.0 range 135 139 90 permit tcp 10.0.8.0 0.0.0.255 10.0.7.1 0.0.0.0 eq 445 100 permit udp 10.0.8.0 0.0.0.255 10.0.7.1 0.0.0.0 eq 445 110 permit udp 10.0.8.0 0.0.0.255 10.0.7.1 0.0.0.0 eq 389 120 permit tcp 10.0.8.0 0.0.0.255 10.0.7.1 0.0.0.0 eq 389 130 permit udp 10.0.8.0 0.0.0.255 10.0.7.1 0.0.0.0 eq 636 140 permit tcp 10.0.8.0 0.0.0.255 10.0.7.1 0.0.0.0 eq 636 150 permit udp 10.0.8.0 0.0.0.255 10.0.7.1 0.0.0.0 eq 464 160 permit tcp 10.0.8.0 0.0.0.255 10.0.7.1 0.0.0.0 eq 1288 170 permit udp 10.0.8.0 0.0.0.255 10.0.7.1 0.0.0.0 eq 1288 180 permit tcp 10.0.8.0 0.0.0.255 10.0.7.1 0.0.0.0 range 49152 50152 190 permit udp 10.0.8.0 0.0.0.255 10.0.7.1 0.0.0.0 range 49152 50152 200 permit icmp 10.0.8.0 0.0.0.255 10.0.7.1 0.0.0.0 8 210 permit icmp 10.0.8.0 0.0.0.255 10.0.7.1 0.0.0.0 0 220 permit udp 10.0.8.0 0.0.0.255 10.0.7.2 0.0.0.0 eq 68 230 permit udp 10.0.8.0 0.0.0.255 10.0.7.2 0.0.0.0 eq 53 240 permit tcp 10.0.8.0 0.0.0.255 10.0.7.2 0.0.0.0 eq 53 250 permit tcp 10.0.8.0 0.0.0.255 10.0.7.2 0.0.0.0 eq 88 260 permit udp 10.0.8.0 0.0.0.255 10.0.7.2 0.0.0.0 eq 88 270 permit tcp 10.0.8.0 0.0.0.255 10.0.7.2 0.0.0.0 eq 123 280 permit tcp 10.0.8.0 0.0.0.255 10.0.7.2 0.0.0.0 range 135 139 290 permit udp 10.0.8.0 0.0.0.255 10.0.7.2 0.0.0.0 range 135 139 300 permit tcp 10.0.8.0 0.0.0.255 10.0.7.2 0.0.0.0 eq 445 310 permit udp 10.0.8.0 0.0.0.255 10.0.7.2 0.0.0.0 eq 445 320 permit udp 10.0.8.0 0.0.0.255 10.0.7.2 0.0.0.0 eq 389 330 permit tcp 10.0.8.0 0.0.0.255 10.0.7.2 0.0.0.0 eq 389 340 permit udp 10.0.8.0 0.0.0.255 10.0.7.2 0.0.0.0 eq 636 350 permit tcp 10.0.8.0 0.0.0.255 10.0.7.2 0.0.0.0 eq 636 360 permit udp 10.0.8.0 0.0.0.255 10.0.7.2 0.0.0.0 eq 464 370 permit tcp 10.0.8.0 0.0.0.255 10.0.7.2 0.0.0.0 eq 1288 380 permit udp 10.0.8.0 0.0.0.255 10.0.7.2 0.0.0.0 eq 1288 390 permit tcp 10.0.8.0 0.0.0.255 10.0.7.2 0.0.0.0 range 49152 50152 400 permit udp 10.0.8.0 0.0.0.255 10.0.7.2 0.0.0.0 range 49152 50152 410 permit icmp 10.0.8.0 0.0.0.255 10.0.7.2 0.0.0.0 8 420 permit icmp 10.0.8.0 0.0.0.255 10.0.7.2 0.0.0.0 0 430 deny ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 log exit 1
pantscat Posted April 23, 2012 Author Posted April 23, 2012 Wow... that's very cool. Thanks very much indeed. I owe you one.
chazzy2501 Posted July 13, 2012 Posted July 13, 2012 I'd love to do what you guys are doing, I'm running a flat network with no additional security. Could you recomend some lab documents for me to get started on. Could I use 802.1x without VLANs just to keep rouge devices from my network? And with wireless... I have basic VLAN knowledge but haven't really understood the routing aspect yet alought I do have L3 switches at the root of my network. (just don't want to test on my real network yet.) oh and what is NPS?
pantscat Posted July 16, 2012 Author Posted July 16, 2012 NPS is Network Policy Server (See here: Network Policy Server) I can't remember what I read that made me think all of this was a good idea (and it is, although I'm only really getting around to properly implementing it now.) - but this (Security Solutions: 802.1X And Guest VLANs - HP ProCurve Networking) looks like a good place to start. 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now