Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are planning to implement 802.1X. What is not clear is whether a switch supporting 802.1X can successfully and correctly authenticate multiple devices connected to the same switch port (e.g. if we have a department using a hub with a bunch of computers to "share" the port)? If so, how does the protocol validate the source of packets?
Or does implementing 802.1X will require us to purchase huge expensive 802.1X supporting switches, for one port per device?

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

You will still be able to do port-based 802.1x authentication but only for the entire hub. As far as the 802.1x authenticator is concerned it is just able to allow or disallow (or assign to different VLANs) that one port that the hub is attached to. Imagine what will happen with a client authenticates this port to a trusted VLAN but then another client authenticates this port to an untrusted VLAN. From the perspective of the authenticator you will not be able to "validate the source of packets" only the port that your hub is attached too (and hence everything that is attached to it).

If you require port-based authentication on a switch or need to authenticate a device that doesn't support 802.1x you can rely on MAC Authentication Bypass, which is essentially just whitelisting MAC addresses or port as required.

To really take advantage of 802.1x you need a switching infrastructure that fully supports 802.1x (luckily it's pretty common on mid-range enterprise grade switches).

share|improve this answer
    
what about multiauth mode? cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/50sg/… –  Alex Nov 25 '11 at 7:47
1  
We're not a Cisco shop so take this with a grain of salt but Multiauth mode looks specifically designed for Cisco's VOIP devices and requires Cisco's proprietary CDP. Take a look at Multiple-Host Mode. –  kce Nov 26 '11 at 0:37
add comment

Mutli-auth does exactly this. Multi-host is an older mode that allows several devices to share the port but once one is authenticated, they all are authenticated. Multi-auth is a newer mode that forces each unique mac address on a port to authenticate individually. However, some features are disabled when you use it such as different radius assigned vlans, guest vlan and auth fail vlan since you cannot assign a vlan per mac address.

Update - Be advised that there is currently a bug in IOS 12.2(54)SG1 with multi-auth and multi-domain where authorized ports do not pass traffic.

Details

share|improve this answer
    
I guess from security point of view it's quite weak? As mac address can be easily sniffed and then spoofed. –  Alex Dec 7 '11 at 8:54
    
You aren't necessarily authenticating with MAC. You can still use certificates or other means to authenticate the devices but the only way the switch can keep track of unique devices on a single port is by mac so, yes if a PC with a valid cert authenticated and then you connected and spoofed the same MAC, I believe you would be granted access on the network, however you can setup periodic re-authentication as well and if this was setup, it is possible that the attacker's PC would respond to the re-auth and cause the port to go unauthorized. Although they could turn off dot1x to avoid this... –  Paul Ackerman Dec 7 '11 at 12:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.