topic Restrict Authentication in Network Access Control

Restrict Authentication

mortezasadeghi — Mon, 29 Apr 2019 05:10:43 GMT

Can we Restrict a client to authenticate on just one physical port?

that's mean the client cannot change its own physical port on a switch.

Re: Restrict Authentication

Dennis Mink — Mon, 29 Apr 2019 05:40:05 GMT

you would need to set up dot1x authentication, port based

Re: Restrict Authentication

balaji.bandi — Mon, 29 Apr 2019 06:13:57 GMT

We need to know your environement, Do you have ISE or any Authentication in your environment. then @Dennis Mink suggested how you can do,

If not only MAC Filter can help you.

Re: Restrict Authentication

mortezasadeghi — Mon, 29 Apr 2019 08:09:43 GMT

hi Dennis Mink

I know.

But I'm asking how can I restrict the user. When they change their physical port, their device will not be authenticated.

Re: Restrict Authentication

mortezasadeghi — Mon, 29 Apr 2019 08:12:21 GMT

We have Cisco ACS

Re: Restrict Authentication

Mike.Cifelli — Mon, 29 Apr 2019 13:05:49 GMT

You have a couple of options. The easy thing would be to do port security on the physical interface. However, port security & 8021x typically are not the best when playing together and in my opinion most people would say not to use both together. You could have your policy server deploy policy as you would with ISE or ACS. I think in order to meet your requirement you could eliminate relying on ISE/ACS and statically configure your one port for you one host with whatever policy you want to include vlan etc. You could then configure the other ports on the switch to use policy from AAA server & ensure the one host you do not want to migrate is not a part of any groups on the AAA server so even if the host moved from one interface to another it would fail authentication/authorization and no longer be on the network.