4

Context:

I'm an admin for a midsize corporate network with several overlapping wireless access points and an ethernet cabling infrastructure. To comply with a security audit, we were recently ordered to implement full device authorization on the network--not just a method for detecting rogue APs and the like, but a full "if your device isn't manually added by us, it can't connect to anything" system.

My first thought was: just create static DHCP MAC-to-IP bindings for everyone, manually, and have people with new devices come to me when they first set up their accounts. I told the auditors, and they said that whatever system we implement cannot be vulnerable to MAC address spoofing or static IP-ing, or else we will remain out of compliance.

I'm aware that there are products out there that will bind to your computer's network connection, and require you to authenticate against some centralized server in order to get network access, but my experience with those (and the Cisco AnyConnect VPN, which works similarly) has been that they can't run on all platforms. Since we have a BYOD environment (not my call), that wouldn't work.

Question:

What software can I run at the network level that prevents devices (any/all devices; arbitrary types/OSes on laptops, random mobile phones, tablets, etc.) from getting network access until I manually add them to our network (ideally without too much hassle during the addition process)? It needs to work similarly on both wired and wireless connections, and not be able to be bypassed by setting a device's MAC address or IP to that of an already-authorized device.

Because of the variety of devices we have, whatever solution we use should be centralized, without extra software requirements on the client. If there's something that fits the bill, but requires client software, I could probably convince management to use it if the client software worked on the majority of our devices (i.e. all *nix laptops, OSX, Windows (xp through 8), iOS, Android, Windows Mobile, BlackBerry), and the oddball users that weren't covered could just deal with it.

|improve this question
  • What kind of authorization are you using for system access? If you are doing kerberos (or AD) or some other kind of two factor authentication you may be able to implement authentication at the switch port level using that. – n8whnp Sep 20 '12 at 20:34
  • Interesting. How/with what technology? – Zac B Sep 20 '12 at 20:35
12

802.1X. This is not something that is trivial to implement, it requires the appropriate security infrastructure to back it up (associated user accounts, etc), but it as far as I know, the only way to even get close to what your auditors are asking for.

It is supported by Windows, Linux, iOS (both the Apple and Cisco versions, so its good for iPads and iPhones), OS X, Windows Mobile (even 2003, vomit), Blackberry, Android, virtually every device that's out there needs to support 802.1X.

|improve this answer
  • I completely forgot you could do 802.1x for wired connections. +1 for the reminder. – Michael Hampton♦ Sep 20 '12 at 20:36
  • 1
    You probably want a combination of 802.1x and port security wherever possible, to make sure that the MAC addresses are only showing up where they're meant to as well. – Mark Henderson♦ Sep 20 '12 at 20:38
  • I just want to add that not every device supports 802.1X in a sane fashion. I've had lots of trouble with the Windows XP native 802.1X implementation. – user62491 Sep 21 '12 at 18:51
2

What you're looking for is called port security (on Cisco switches at least). You need managed switches for this kind of access control.

|improve this answer
  • 2
    But does that work for wirelessly-connected clients? Also, I've worked in networks that use port security before, and it's vulnerable to MAC address spoofing. – Zac B Sep 20 '12 at 20:33
  • For wireless connections you'd user other means, e.g. RADIUS. – Ansgar Wiechers Sep 20 '12 at 20:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.