Centralized MAC Address Filtering under RADIUS
theophilix
-
brupala Posted messages 111140 Registration date Status Member Last intervention -
brupala Posted messages 111140 Registration date Status Member Last intervention -
Hello everyone,
I would like to have your advice and help.
In my internship, I set up a Radius server on Windows Server 2008R2, and I would like to implement centralized MAC address filtering through Radius.
Let me explain, when a user connects with the workstation in the company, the switch sends the MAC address of the workstation to request authentication from the Radius server. The server checks if the MAC address is correctly listed in a database (Active Directory) and assigns it to the appropriate VLAN (local VLAN for registered MAC addresses, and guest VLAN for unrecognized devices). I have already set up user authentication via username/password in a test network by enabling 802.1X on the switch, which worked well.
However, my tutor wants an automatic and centralized authentication by MAC address (independently of the user), the goal is to prevent visitors from connecting to company resources when they come with their laptops to connect to the network. These visitors should be automatically assigned (based on an unregistered MAC address) to a guest VLAN that provides internet access but no access to the local network.
My question is as follows:
I have successfully installed NPS, and I have added a Radius Client "name, IP, shared secret."
The test switch is a level 2: Zyxel ES-2108 Series switch, ZyNOS F/W Version V3.80 (ABS.2) dated 11/23/2009
After that, I don't know what to do.
I have searched online and on forums but found nothing that could help me implement this solution.
I would be grateful for your assistance.
Thank you.
I would like to have your advice and help.
In my internship, I set up a Radius server on Windows Server 2008R2, and I would like to implement centralized MAC address filtering through Radius.
Let me explain, when a user connects with the workstation in the company, the switch sends the MAC address of the workstation to request authentication from the Radius server. The server checks if the MAC address is correctly listed in a database (Active Directory) and assigns it to the appropriate VLAN (local VLAN for registered MAC addresses, and guest VLAN for unrecognized devices). I have already set up user authentication via username/password in a test network by enabling 802.1X on the switch, which worked well.
However, my tutor wants an automatic and centralized authentication by MAC address (independently of the user), the goal is to prevent visitors from connecting to company resources when they come with their laptops to connect to the network. These visitors should be automatically assigned (based on an unregistered MAC address) to a guest VLAN that provides internet access but no access to the local network.
My question is as follows:
I have successfully installed NPS, and I have added a Radius Client "name, IP, shared secret."
The test switch is a level 2: Zyxel ES-2108 Series switch, ZyNOS F/W Version V3.80 (ABS.2) dated 11/23/2009
After that, I don't know what to do.
I have searched online and on forums but found nothing that could help me implement this solution.
I would be grateful for your assistance.
Thank you.
3 answers
-
Hi, this is really a great internship topic that I would have loved to have in my studies. You really touch on everything when you deal with radius, network and system administration VLAN, AD, LDAP,...
I will try to look into it at home tonight, I'm at work right now. If you have the solution by then, please share it ;) -
-
Hello,
actually, it’s VLAN by MAC address that needs to be done, but I don’t think it can be managed by RADIUS, as it’s always implemented in a proprietary way and too cumbersome to manage.
Your master didn’t have a good idea to go in that direction: it’s the users that need to be filtered, not the machines, on one hand, and on the other hand, in terms of security, a MAC address is so easy to change…
There’s also port security, but it doesn’t allow that at the network level with RADIUS.
--
and ... There you go!
