Configuring dot1x

Posted by Bradley | Security | Wednesday 23 September 2009 20:54

I have been flying though some of the labs and the experience is really humbling there is tonnes of stuff that I have never configured before and it takes me a little bit of time to get used to. One of these items is dot1x authentication so below is a brief command reference/primer for the commands.

Right first off we need to enable the aaa new model

DistSwitch(config)#aaa new-model

Then we need to configure dot1x to be used for authentication and as dot1x uses radius define the radius server, pretty standard stuff

DistSwitch(config)#aaa authentication dot1x default group radius
DistSwitch(config)#radius-server host 10.10.10.100 key secretkey

To prevent bad things from happening such as locking yourself out use the following command to only use local login for the lines

DistSwitch(config)#aaa authentication login default line

Now for the interface configuration, to use dot1x the ports must be access ports so lets sort that out

interface FastEthernet0/1
 switchport mode access

This is the most important command and specifies that the port should be either force-authorised where the port is always allowed on the network, force-unauthorised where the port is never allowed on the network, and finally auto where the port is either authorised if dot1x authentication succeeds or unauthorised if it doesnt.

DistSwitch(config-if)#dot1x port-control ?
  auto                PortState will be set to AUTO
  force-authorized    PortState set to Authorized
  force-unauthorized  PortState will be set to UnAuthorized

Still on the interface there are are a couple more useful commands, the next command puts the port into the specified vlan if authentication fails

DistSwitch(config-if)#dot1x auth-fail vlan 666

And this command puts the port in the specified vlan if the connected host does not support dot1x, handy for guests

DistSwitch(config-if)#dot1x guest-vlan 90

And always there is a couple of show commands that we need to do to check that everything is working correctly. To check the queries and responses sent to each radius server just use;

DistSwitch#show aaa servers

RADIUS: id 1, priority 1, host 10.10.10.100, auth-port 1645, acct-port 1646
     State: current UP, duration 1743s, previous duration 0s
     Dead: total time 0s, count 0
     Quarantined: No
     Authen: request 0, timeouts 0
             Response: unexpected 0, server error 0, incorrect 0, time 0ms
             Transaction: success 0, failure 0
     Author: request 0, timeouts 0
             Response: unexpected 0, server error 0, incorrect 0, time 0ms
             Transaction: success 0, failure 0
     Account: request 0, timeouts 0
             Response: unexpected 0, server error 0, incorrect 0, time 0ms
             Transaction: success 0, failure 0
     Elapsed time since counters last cleared: 12m

And to see the dot1x interface specific information the following command provides that information

DistSwitch#show dot1x interface fa0/1
Dot1x Info for FastEthernet0/1
-----------------------------------
PAE                       = AUTHENTICATOR
PortControl               = AUTO
ControlDirection          = Both
HostMode                  = SINGLE_HOST
Violation Mode            = PROTECT
ReAuthentication          = Disabled
QuietPeriod               = 60
ServerTimeout             = 0
SuppTimeout               = 30
ReAuthPeriod              = 3600 (Locally configured)
ReAuthMax                 = 2
MaxReq                    = 2
TxPeriod                  = 30
RateLimitPeriod           = 0
Auth-Fail-Vlan            = 666
Auth-Fail-Max-attempts    = 3
Guest-Vlan                = 90

3 Comments »

  1. Comment by appelmoes — 25 September, 2009 @ 05:58

    try

    dot1x port-control auto

    aaa authentication dot1x default group radius

    and not

    DistSwitch(config)#aaa authentication login default line

  2. Comment by Roland — 3 October, 2009 @ 22:27

    802.1x is a great tool with a poor OS support. I’m experiencing problems with WinXP clients and DHCP: the client gets an IP address from unauth VLAN and when the authentication completes it keeps the old ip address in the new vlan so a ipconfig /release and /renew is needed. I’m using WinXP SP2 and SP3 with the same results. The client-side problems are a big issue in implementing 802.1x, I had to pause the whole project. Other dot1x clients fix that problem but it’s hard to tell the customer to buy a new client and install it in >1000 clients when EAP is supposed to be a OS feature free of charge. What’s your experience?

  3. Comment by Bradley — 5 October, 2009 @ 10:46

    Hey Roland, many of the sites in our network have implemented dot1x for the wireless clients, its setup so they can travel to institutions throughout the world and still use the same credentials and is pretty successful http://www.eduroam.org

    The biggest barrier we have found to deployment is sites understanding the technology, apart from the problem you described with changing VLANs the technology seems ready for prime time.

RSS feed for comments on this post. TrackBack URI

Leave a comment