dpsguard

And of course, I will first try to DMcCoy's suggestions and see if only a single IAS can achieve what I need to do. This is still under planning stage and we need to buy Procurve even to test it. I expect to test it by middle of October and then report back. Thanks both of you for your excellent responses and great knowledge. I have mainly been dealing in Cisco.

Folks, Looks like we have a solution to use two Radius servers, one for 802.1x and second for mac authen. The trick will be to configure two Radius servers in switches on two different subnets / VLANs and then on the upstream Distribution / Core L3 switch, add ACL to each VLAN denying access to the other radius server IP address. If someone can lab this up, that will be great as it will take me a while to get all this together. Thanks

Yes, I will also need to use the same IAS Radius for 802.1x for users and mac authen for printers and other machines which are not capable of running 802.1x. The users will then be in main domain and mac authen devices will be another domain. So IAS will need to talk to two domains, unless there is a way to not disable password complexity policy on AD globally. That is why I was considering two more options, one having port security ( have only 4 edge switches and there can be ports set aside on each for printers etc that are mobile and add limited such printers be addded to all such edge switches) and the second one to simply have a FreeRadius based Radius only for mac authentication with such devices put into a separate VLAN / set of ports, but need to figure out how these ports will use only FreeRadius and not be directed to IAS. Thanks

Thanks Localzuk. It is making sense to me. I am a network guy and not windows admin, so I have very limited knowledge on window NOS side. I believe on an existing W2k3 domain controller, we can certainly add another domain for mac address users ( and have two way trust between these two domains), but then how does the IAS talk to two domains on the DC? IAS will be enrolled / registered with only main domain and thus forward requests only to main domain. I guess then DC has to somehow pass on the credentials to the second domain database, but then it will fail as seocnd domain database will see domain name appended to credentials being the main domain name. Just as a curiosity, is there a way to add local user accounts (in this case mac accounts) to switch and then use local authentication? Please advise. Thanks

Thanks DMcCoy. I just read your reply after I wrote this. I understand now that IAS append the domain name (being enrolled on domain) while forwarding username / password as AD will definately like to see domain name coming in else it will simply reject it. I am still not clear about my question #3. I believe this is only required if MD5 option is selected under 802.1x instead of PEAP option as in case of MD5 802.1x, the comparison has to be made between one way hashed password. But in my case, I am not using 802.1x anyway for mac authentication. Appreciate again and look forward to more feedback on this.

Really appreciate your support and prompt response. 1. Too bad that Windows 2003 server will not allow this and then the only option is to either disable the password complexity globally or to forget about radius based mac authentication and then simply user port security commands to add these mac addresses to respective switch port. The only problem then is that we can not move these devices to other than assigned ports. The other solution that can be explored is to use a second radius server ( Linux FreeRADIUS) that will have these mac address accounts created and service these devices, but I have to figure out if Procurve switch will allow to take two RADIUS servers for the purpose of authenticating requests coming in from two separate set of ports. I know we can specify even 4 radius servers, but they are all for failover. 2. So you mean, AD will authenticate a user ( a printer in this case with its mac address being passed on to IAS by switch as both username and password) even if it presents only username / password and no domain name? 3. I think I could not explain this better. I meant to ask if mac address accounts that I will create in AD, will these be required to be stored as hashed MD5 as there is an option to check or uncheck this on user accounts while creating passwords. Please advise. Thanks again.

Hi All, I want to do Mac address authentication for some printers and few other devices on Procurve 2600 switch, with Radius IAS. I have a couple of questions and will really appreciate guidance on this. 1. I understand that I need to create a separate group in AD to include the mac authentication user accounts with accounts having username and password to be same and clear password complexity unders ecurity policy for this so that I will be allowed to have password to be same as username. Can this security policy relaxation for password be only applied to this mac authentication group? 2. When the switch will forward the username and password to be the mac address to the IAS and IAS will then relay it to AD for validation, AD will expect supply of a domain name as well. How does the domain name gets appended to the mac authentication credentials sent by switch to the IAS? 3. Since I am not doing mac authentication for user window machines, I believe the accounts do not need to be stored with reversible MD5 encryption. Please clarify this as well. Thanks a lot.