Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The title is not a mistake, I really am talking about wired, not wireless.

Essentially, I was wondering if it was possible to password-protect a LAN wired network to enhance security and only allow computers knowing the password to join.

I thought about using MAC address filtering, but that is way too trivial to circumvent.

Any ideas?

Thanks!

share|improve this question
1  
There's some quite effective methods of Layer 2 security a lot more powerful that MAC address filtering, but they're generally quite expensive to implement. –  Mark Henderson Mar 15 '11 at 23:45

2 Answers 2

802.1x authentication will do what you're looking for. Your switches will need to support it and you'll need a RADIUS server (which isn't a big deal because there are Free and no-cost options for most mainstream operating systems). Depending on how you actually do the authentication (certificates deployed on client computers, username / password on the clients) you may have addt'l steps necessary (like deploying a PKI) to get 802.1x up and going.

If you're using a Microsoft server platform you can get some background from them here: http://technet.microsoft.com/en-us/library/cc753354(WS.10).aspx

Some Linux server background (as well as just good background about 802.1x) is available here: http://www.linux.org/docs/ldp/howto/8021X-HOWTO/index.html

share|improve this answer
1  
a I fully agree this is most secure, but in terms of ease a captive portal is much better. –  Jacob Mar 16 '11 at 1:58
1  
802.1x isn't that difficult to get going w/ modern OS's and switches. My advice to the OP would be to take a little extra time and put together a solution that has some reasonable security behind it and that works well in his environment. –  Evan Anderson Mar 16 '11 at 2:34
    
@even I fully agree 802.1x is great, but in certain cases captive portals might be better... –  Jacob Mar 16 '11 at 2:44
    
@jacob I disagree with the captive portal idea. With .1x one could use the switch extended capabilities like: make vlan assingments. This is a better security tool. –  cstamas Mar 16 '11 at 7:42

What you are looking for is called a captive portal. You would have to look around to find one that works with the switches you use though. Basically, all unauthenticated ports should be on their own isolated vlan. Once someone authenticates on a port, it would be moved over to the normal vlan, and the traffic would work normally.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.