This post covers an innovation project I did to secure the wired network at a shared conf center with 802.1X.
Every few months we had to disable the wired network in order to prevent non-employees from being able to get online. This was not scalable, was prone to human error, and scheduling confusion. I planned to automate the process by enabling 802.1X aka dot1q on the switches using our Windows AD via Cisco ACS.
Any Domain joined devices that plugged in would get access to our corp VLAN, and unknown devices would go into a dead VLAN. Long term I planned to enable a wired guest VLAN and had it labbed out for non local switched wifi where the guest VLAN exists on the switch you’re connected to but didn’t around to labbing local switching using CAPWAP tunnels.
Wired Guest Access using Cisco WLAN Controllers Configuration Example:
Phones would end up in the VoIP VLAN but they weren’t equipped for dot1x authentication. So I had two options either manually add each MAC address to a list in the ACS which is not scalable or supportable. Instead I removed the user VLAN from the ports with phones connected. The voice VLAN itself was locked down with a strict ACL that only allowed communication with the VoIP server.
Client configs:
In this environment there were only Windows clients. Windows needs to be configured to enable their supplicant for dot1x. Anything with Windows can and should be controlled by Group Policy. I researched the needed settings and how to set them via GPO. Then I worked with the Windows team to roll out the GPO to a pilot group and finally deploy globally.
Configuring 802.1X Wired Authentication on a Windows 7 Client:
You can do the same thing with other versions of Windows just this was the one I worked with.
Windows AD GPO guide:
https://msdn.microsoft.com/en-us/library/dd759237.aspx
When these Win 7 machines were upgraded to Win 10 the GPO still worked.
Switch configs:
!Debug 802.1x all !Debug radius all conf t aaa new-model aaa authentication dot1x default group radius aaa authorization network default group radius aaa accounting network default start-stop group radius dot1x system-auth-control dot1x guest-vlan supplicant radius server acs1.foo.com address ipv4 10.1.181.2 auth-port 1812 acct-port 1813 key 0 This-IsTheSharedSecret123 exit radius server acs2.foo.com address ipv4 10.2.181.2 auth-port 1812 acct-port 1813 key 0 This-IsTheSharedSecret123 exit !User ports interface <interface> authentication port-control auto authentication host-mode multi-domain dot1x pae authenticator authentication event no-response action authorize vlan 15 authentication event fail action authorize vlan 15 !Phone ports interface <interface> no switchport access vlan 1010 end copy run start
ACS Configs:
I already had the ACS configured to do dot1x auth for wifi clients so it was simple to just add the new switches to the rule set.
It was a success and opened the door to securing all wired networks.
