Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Apologies my networking skills are a tad rusty. I'm looking for a way to setup a system that gives me the ability to setup Role-based access to specific network resources. For example, i have three private subnets for specific groups, users will need access to one one or more subnets.

I'd like to have all client machines on the same subnet/vlan, and then use 802.1x to authorize the system, then use that authentication conversation to determine which routing group(s) to put them in.I've searched and found quite a bit on getting ACL's to hand out the appropriate VLAN, however, nothing on even if its possible to get that authentication tied in with routing.

We have many users that wear cross-departmental hats, and would be nice if we could give access to only those necessary. I.e. User X does most of their work in Department Y, but has resources in Department Z that are useful for User X's job, but nobody else in Department Y should be accessing.

I see many offerings from Cisco & packetfence can help decide what VLAN a user goes into, but i need to make sure i can get users access to other subnets.

share|improve this question
Is there a driving reason you're trying to do this at the network layer? –  SpacemanSpiff Nov 7 '12 at 1:38
As nice as 802.1x is, it cannot replace a real firewall... I think you need to look at this as a solution to your problem –  Mike Pennington Nov 7 '12 at 3:37
I'm trying to segregate networks users have access to, as an extra layer of security. I'm not trying to replace a real firewall. I'm trying to add to the ability of my firewall, so i can make sure the network layer is tight. –  Steve Butler Nov 7 '12 at 14:58
I am starting to wonder about IPSec, and if this is the direction i need to be headed. –  Steve Butler Nov 7 '12 at 17:50
IPsec looks nice, but it still makes me wonder what it takes to give different users different ACL's based on their LDAP group membership. I can't be the only one trying to do this can I? –  Steve Butler Nov 9 '12 at 3:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.