2

I just wanted to see if anyone else has had luck implementing 802.1x over ethernet. So here's my basic setup. Switch sends out 3 eapol messages spaced out 5 seconds apart. if there's no response the machine gets put on a guest vlan with restricted access. If the machine is properly configured it will authenticate and be placed into a secure vlan. About 10% of my windows xp users are getting self assigned 169 addresses. I've used the Odyssey Access Client and it worked without a hitch. I'm using the setting to automatically use the users windows login to authenticate, but it's workign on 90% of the machines so I don't think that's the issue. Checking the logs on the dc it seems that the machines are trying to authenticate with computer credentials even though they are configured not to.

I'm running Juniper switches with IAS for radius. I have radius configured for PEAP and MSvhapv2. Macs and linux boxes seem to have no issues authenticating.

One last thing to add If I unplugging the ethernet cable and plug it back in usually resolves the issue, but I'd hardly call that acceptable for production.

Kinda long winded and specific for a discussion, but just want to see if anyone else has had similar issues or experiences, or if anyone knows of a free XP supplicant that actually works with 802.1x over ethernet.

4 Answers 4

1

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/8021x_client_configure.mspx?mfr=true

Windows can talk to radius servers fine so I'd suggest using the built in windows client as it has yet to fail on me.

0

You can try this supplicant: www.securew2.com

This seems to be popular in the European research network.

2
  • I was looking at that as well, but it's only an educational/personal license so I wouldn't legally be able to use it for this project. I think I'm going to focus on getting a good price for the odyssey access client since I know it will get the job done properly and is easy to deploy. Jun 29, 2009 at 22:32
  • Yes, it is true. I did not noticed this yet. :-(
    – cstamas
    Jun 30, 2009 at 14:40
0

I had it working on a 1/2 dozen workstations using a Catalyst switch and Cisco ACS as the Radius. I only had WinXP and linux clients to test with, but it seemed reasonably straightforward.

0

Finally got budget to buy Odyssey Access Client. It lets you set the username and passwords for ethernet prfoiles like you can on wireless profiles in windows(not sure why Microsoft didn't give the same options on both supplicants to make my life easier :P).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .