Security

last person joined: 19 hours ago 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

Prevent NAT behind RAP

This thread has been viewed 1 times

  • 1.  Prevent NAT behind RAP

    Posted Feb 17, 2012 12:29 PM

    Has anyone encountered a similar security concern and have any effective method of dealing with it...

     

    Currently we are looking to do 802.1x authentication on the wired port of our RAP devices. Corp PCs would have the correct LAN profile and dot3svc service running. Concern has been raised that a NAT box could be connected to the RAP, with permitted and non-permitted clients behind that. The one permitted client would authenticate, thus putting the NAT box in an employee user-role and allowing access from all non-permitted devices connected to it.

     

    I was thinking of layering a MAC filter on top of 802.1x but that doesn't stop MAC spoofing. Is there anything either built in or external which can anyone has done to address this threat?



  • 2.  RE: Prevent NAT behind RAP

    EMPLOYEE
    Posted Feb 17, 2012 01:12 PM

    Not sure if a 802.1x frame can even  be passed successfully through a NAT boundary.  If you are not allowing devices that do not pass 802.1x, then putting a nat box behind the RAP will not allow any unauthenticated users.