Re: 802.1x Question

[Guillaume Germain <ggermain () GMAIL COM>]

Implementing 802.1x on your network would likely improve your network
security greatly from what it is now... If you leave your access to
your DC open for the auth ports I still see this as a huge improvement
over what you currently have...

Also, if you do go the Guest VLAN route, you can put authentication
(using web auth) on that, so people who end up in this network are
already authenticated.

GG

Or you could just have

On Tue, Mar 29, 2011 at 12:38 PM, Sam Walker <swalker () wvsom edu> wrote:
> I wished to obtain some opinions on a particular topic.  We are reviewing
> new proposals for our network configuration, and came across an issue we
> have debated internally.  To offer some background, our network requirements
> were to provide a dynamic configuration of both wired and wireless ports.
> In the past, each port (student or faculty/staff) were static.
>
> One proposal included the following configuration using 802.1x.  By default,
> all devices would be placed within a guest VLAN.  A Cisco ACS server would
> be configured to authenticate against our local Active Directory database
> for group membership.  So if a faculty user account is used, the machine
> would be placed within the faculty/staff VLAN.  If a student logs in, the
> device would be placed within the student VLAN.  If the device is not
> successfully authenticated, it would remain within the guest VLAN.
>
> The problem we have determined is the access required by the guest VLAN.
> Since it is the default VLAN initially, it would require access to our
> Active Directory domain controllers to authenticate.  If someone would take
> a new machine and wished to add it to our local Windows domain, it too would
> need access to the domain controllers.  But this appears to be a huge
> security hole to us, as a machine within the guest VLAN would have direct
> access to our DC’s.
>
> So we wished to query how others were handling 802.1x authentication.  One
> potential solution would be to have another VLAN as the initial value, and
> place devices that would not authenticate successfully to the guest VLAN.
> But we wished to obtain some opinions on this subject before moving
> forward.  Thanks.