- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
12-03-2014 02:17 PM
hay
is it possible to mix
802.1X authentication in the radius server + mac authentication in the local db
and if it is possible , will this not allow users with registred mac address to access freely to the Guest ssid (in the case of using captive portal)
Raouf CHAHBOUNE
ICT Network & Security Engineer
CCNP R/S | CCNA Security | ACMP|ACCP|ACDX
[If my post is helpful please give kudos, or mark as solved if it answers your post.]
Solved! Go to Solution.
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Alert a Moderator
Re: 802.1X auth + MAC auth
Re: 802.1X auth + MAC auth
12-03-2014 02:38 PM
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Alert a Moderator
Re: 802.1X auth + MAC auth
Re: 802.1X auth + MAC auth
12-03-2014 02:56 PM - edited 12-03-2014 02:59 PM
I thought it was possible
I already tried the auth PSK + MAC auth (local db) and work
why is 802.1X authentication different
Raouf CHAHBOUNE
ICT Network & Security Engineer
CCNP R/S | CCNA Security | ACMP|ACCP|ACDX
[If my post is helpful please give kudos, or mark as solved if it answers your post.]
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Alert a Moderator
Re: 802.1X auth + MAC auth
Re: 802.1X auth + MAC auth
12-03-2014 03:01 PM
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Alert a Moderator
Re: 802.1X auth + MAC auth
Re: 802.1X auth + MAC auth
12-03-2014 03:05 PM
You will need a policy engine like ClearPass to do what you are asking.
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Alert a Moderator
12-03-2014 04:49 PM
This is not possible on a WLAN...this can work on a wired LAN.
Consulting Systems Engineer - ACCX, ACDX, ACMX
Email: seth@hpe.com
-----
If you found my post helpful, please give kudos
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Alert a Moderator
12-04-2014 06:38 AM
Hi,
It is obsolutely possible to configure both MAC and dot1x together. even possible to configure MAC with internal and dot1x with external radius.
the trick is post auth role of MAC authentication, change it to logon role so that it can allow required traffic otherwise if it is a guest role you may issues.
in the bellow output you can see that I have enabled both MAC and dot1x auth in the AAA profile and auth trace buff you can see both are success full.
Hope you got the answer,
feel free to ask furhter questions if you have any.
Cheers,
Venu Puduchery
for your Ref :
(Aruba3200) #show aaa profile MyAAA
AAA Profile "MyAAA"
-------------------
Parameter Value
--------- -----
Initial role logon
MAC Authentication Profile MyMAC
MAC Authentication Default Role logon
MAC Authentication Server Group internal
802.1X Authentication Profile Mydot1x
802.1X Authentication Default Role authenticated
802.1X Authentication Server Group MyServer
Download Role from CPPM Disabled
L2 Authentication Fail Through Disabled
Multiple Server Accounting Disabled
User idle timeout N/A
RADIUS Accounting Server Group N/A
RADIUS Interim Accounting Disabled
XML API server N/A
RFC 3576 server N/A
User derivation rules N/A
Wired to Wireless Roaming Enabled
SIP authentication role N/A
Device Type Classification Enabled
Enforce DHCP Disabled
PAN Firewall Integration Disabled
Dec 4 19:26:03 station-down * 40:30:04:83:fa:21 24:de:c6:b9:62:18 - -
Dec 4 19:26:20 mac-auth-req -> 40:30:04:83:fa:21 24:de:c6:b9:62:18 - -
Dec 4 19:26:20 mac-auth-success <- 40:30:04:83:fa:21 24:de:c6:b9:62:18 - -
Dec 4 19:26:20 station-up * 40:30:04:83:fa:21 24:de:c6:b9:62:18 - - wpa2 aes
Dec 4 19:26:20 station-term-start * 40:30:04:83:fa:21 24:de:c6:b9:62:18 10 -
Dec 4 19:26:25 client-finish -> 40:30:04:83:fa:21 24:de:c6:b9:62:18/Mydot1x - -
Dec 4 19:26:25 server-finish <- 40:30:04:83:fa:21 24:de:c6:b9:62:18/Mydot1x - 61
Dec 4 19:26:25 server-finish-ack -> 40:30:04:83:fa:21 24:de:c6:b9:62:18/Mydot1x - -
Dec 4 19:26:25 inner-eap-id-req <- 40:30:04:83:fa:21 24:de:c6:b9:62:18/Mydot1x - 35
Dec 4 19:26:25 inner-eap-id-resp -> 40:30:04:83:fa:21 24:de:c6:b9:62:18/Mydot1x - - jack
Dec 4 19:26:25 eap-mschap-chlg <- 40:30:04:83:fa:21 24:de:c6:b9:62:18/Mydot1x - 67
Dec 4 19:26:25 eap-mschap-response -> 40:30:04:83:fa:21 24:de:c6:b9:62:18/Mydot1x 8 49
Dec 4 19:26:25 mschap-request -> 40:30:04:83:fa:21 24:de:c6:b9:62:18/Mydot1x 8 - jack
Dec 4 19:26:25 mschap-response <- 40:30:04:83:fa:21 24:de:c6:b9:62:18/Myradius - - jack
Dec 4 19:26:25 eap-mschap-success <- 40:30:04:83:fa:21 24:de:c6:b9:62:18/Mydot1x - 83
Dec 4 19:26:25 eap-mschap-success-ack-> 40:30:04:83:fa:21 24:de:c6:b9:62:18/Mydot1x - -
Dec 4 19:26:25 eap-tlv-rslt-success <- 40:30:04:83:fa:21 24:de:c6:b9:62:18/Mydot1x - 43
Dec 4 19:26:25 eap-tlv-rslt-success -> 40:30:04:83:fa:21 24:de:c6:b9:62:18 - 2
Dec 4 19:26:25 eap-success <- 40:30:04:83:fa:21 24:de:c6:b9:62:18/Mydot1x - 4
Dec 4 19:26:25 wpa2-key1 <- 40:30:04:83:fa:21 24:de:c6:b9:62:18 - 117
Dec 4 19:26:25 wpa2-key2 -> 40:30:04:83:fa:21 24:de:c6:b9:62:18 - 117
Dec 4 19:26:25 wpa2-key3 <- 40:30:04:83:fa:21 24:de:c6:b9:62:18 - 151
Dec 4 19:26:25 wpa2-key4 -> 40:30:04:83:fa:21 24:de:c6:b9:62:18 - 95
Venu Puduchery,
[Is my post helped you ? Give Kudos :) ]
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Alert a Moderator
Re: 802.1X auth + MAC auth
Re: 802.1X auth + MAC auth
12-04-2014 08:36 AM
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Alert a Moderator