Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just wanted to see if anyone else has had luck implementing 802.1x over ethernet. So here's my basic setup. Switch sends out 3 eapol messages spaced out 5 seconds apart. if there's no response the machine gets put on a guest vlan with restricted access. If the machine is properly configured it will authenticate and be placed into a secure vlan. About 10% of my windows xp users are getting self assigned 169 addresses. I've used the Odyssey Access Client and it worked without a hitch. I'm using the setting to automatically use the users windows login to authenticate, but it's workign on 90% of the machines so I don't think that's the issue. Checking the logs on the dc it seems that the machines are trying to authenticate with computer credentials even though they are configured not to.

I'm running Juniper switches with IAS for radius. I have radius configured for PEAP and MSvhapv2. Macs and linux boxes seem to have no issues authenticating.

One last thing to add If I unplugging the ethernet cable and plug it back in usually resolves the issue, but I'd hardly call that acceptable for production.

Kinda long winded and specific for a discussion, but just want to see if anyone else has had similar issues or experiences, or if anyone knows of a free XP supplicant that actually works with 802.1x over ethernet.

share|improve this question
add comment

4 Answers

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/8021x%5Fclient%5Fconfigure.mspx?mfr=true

Windows can talk to radius servers fine so I'd suggest using the built in windows client as it has yet to fail on me.

share|improve this answer
add comment

You can try this supplicant: www.securew2.com

This seems to be popular in the European research network.

share|improve this answer
    
I was looking at that as well, but it's only an educational/personal license so I wouldn't legally be able to use it for this project. I think I'm going to focus on getting a good price for the odyssey access client since I know it will get the job done properly and is easy to deploy. –  maxxpower Jun 29 '09 at 22:32
    
Yes, it is true. I did not noticed this yet. :-( –  cstamas Jun 30 '09 at 14:40
add comment

I had it working on a 1/2 dozen workstations using a Catalyst switch and Cisco ACS as the Radius. I only had WinXP and linux clients to test with, but it seemed reasonably straightforward.

share|improve this answer
add comment
up vote 0 down vote accepted

Finally got budget to buy Odyssey Access Client. It lets you set the username and passwords for ethernet prfoiles like you can on wireless profiles in windows(not sure why Microsoft didn't give the same options on both supplicants to make my life easier :P).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.