up vote 1 down vote favorite
1
share [g+] share [fb]

What standards/protocols/products exist that support encryption of all data sent between a device (e.g. a workstation) and a LAN switch? Something like WPA for WLAN.

link|improve this question
80% accept rate
IPSec is a higher layler protocol, do you specifically want Link Layer encryption? – Marcin Dec 5 '11 at 13:50
feedback

4 Answers

up vote 1 down vote accepted

I"m not sure how to reply to the above post but here's my response to your question to Rory. In multi-host mode, you can support multiple clients behind a single port but it isn't great because as long as one device authenticates, the entire port is authorized for all clients. Multi-auth is better because it forces each unique mac to authenticate but you lose the ability to use guest vlans, authentication fail vlans and multiple radius provided vlans in certain cases. Also, there is a bug in multi-auth and multi-domain in IOS 12.2(54) SG1 on at least the 4500 series switches. See for details: https://supportforums.cisco.com/thread/2044456. I have these features working with netgear and d-link little 5 port desktop switches - not just Cisco branded gear. Dot1x is more for authenticating clients before they connect to the network. For client to server encryption IPSec is the way to go and can be configured completely (and for free) via GPO

link|improve this answer
feedback
up vote 1 down vote

Any IP traffic can be secured using IPSEC – whether it's on LAN or WAN.

However, it is more complicated in LANs – as you have to deal with setting up SA's (security associations) and key management (if not using PSKs). With Windows you can integrate the key management into active directory, but you also need Certificate infrastructure to support distribution of certificates to clients, and how do they get the certificates if traffic isn't already encrypted.

link|improve this answer
I have found some information about Cisco TrustSec, it talks about IEEE 802.1AE for encryption and 802.1X for authentication, access control etc. I think this is more like what our company is looking for, as IPsec seems to be more for encryption between a server and client, not between 2 clients. – Alex Nov 30 '11 at 7:25
1  
IPsec will encrypt any TCP/IP connection. It's definitely the way to go. – JoelESalas Nov 30 '11 at 7:29
It's strange that nobody suggests 802.1X-2010 – Alex Nov 30 '11 at 8:11
feedback
up vote 1 down vote

802.1x works fine on a single vendor LAN (my experience has been with Cisco ones) - and in fact has less challenges from a management perspective than IPSec in an Enterprise environment.

If you use Cisco for your LAN I'd probably suggest this as it is straightforward to implement.

link|improve this answer
Does this option mean we have to connect all endpoint devices to Cisco switch ports (which means more cables in the walls and more or bigger Cisco switches), or we can still use "small" switches/hubs in each department (room)?? I have heard mixed feedback, some say each port can only authenticate one device attached to it (making use of hubs impossible), others say there is MultiAuth, MultiHost modes (with not much documentation on this), yet others say MultiAuth and MultiHost modes are for Cisco branded devices only (like their access points, sip phones etc). – Alex Dec 1 '11 at 1:49
feedback
up vote 0 down vote

you mean something like RADIUS?

link|improve this answer
2  
Almost certainly not - Radius is an AAA solution, it does nothing at all to encrypt transmitted data. – Chopper3 Dec 5 '11 at 12:30
right; i don't see why OP wouldn't just run IPSEC over RADIUS and be done with it. auth plus encryption. i felt the need to mention IPSEC redundant, as it's already been mentioned. – brent saner Dec 5 '11 at 12:40
and again this makes no sense at all - can you explain what you mean by this please - Radius is simply an AAA solution and has no bearing whatsoever on encryption. – Chopper3 Dec 5 '11 at 12:55
it doesn't have anything to do with encryption, no. but take note of OP's request: "...Something like WPA for WLAN." if he's looking to emulate that sort of implementation into a LAN analog, he'll want the encryption (which could be handled by, as others have mentioned, IPSEC) AND an underlying auth framework- per my suggestion, RADIUS. i have a feeling this is getting us nowhere, so i'm done discussing this as we seem to be going in circles. – brent saner Dec 5 '11 at 13:01
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.