topic Re: NAC Policy for OS Boot vs Initial Boot in Network Access Control

NAC Policy for OS Boot vs Initial Boot

network_geek1979 — Thu, 16 Feb 2023 12:23:38 GMT

Folks,
I needed some suggestion on Policies getting applied when the 802.1x authentication kicks in vs Initial Boot by a system.

Our policies say that once the 802.1x authentication succeeds allow the machine to get authorized on the "Employee VLAN". This policy works just fine, but the catch here is when the system performs an initial boot the system does not get in the "Employee VLAN", which is expected as the OS cannot perform a 802.1x authentication.

Any suggestions to overcome this challenge?

Thanks!
N.

Re: NAC Policy for OS Boot vs Initial Boot

balaji.bandi — Thu, 16 Feb 2023 12:29:54 GMT

You mean PXE boot ?

Re: NAC Policy for OS Boot vs Initial Boot

network_geek1979 — Thu, 16 Feb 2023 12:55:29 GMT

Hi BB,
No not PXE boot. This is just the initial boot screen, i.e. when the Laptop is first powered on.
(Or for that matter it is left idle for some time....even here we seen at times the "Employee VLAN" gets lost and the Laptop for in the "Guest VLAN")

Thanks!
N

Re: NAC Policy for OS Boot vs Initial Boot

ahollifield — Thu, 16 Feb 2023 14:01:35 GMT

I assume you are doing user auth? If so there is no 802.1X transaction by design until a user logs into the system. You should also enable machine authentication if you need to provide network access before login. That being said, why change VLANs at all? Why not use a dACL or some other enforcement method?

Re: NAC Policy for OS Boot vs Initial Boot

network_geek1979 — Thu, 02 Mar 2023 12:52:22 GMT

@ahollifield : Thanks for the answer and apologies for the late response.
Any details you can share on machine authentication? This is new to us and would like to check how this can work.
Thanks a ton.

Regards,

Re: NAC Policy for OS Boot vs Initial Boot

ahollifield — Thu, 02 Mar 2023 13:19:04 GMT

These are windows endpoints correct? If so enable "Computer Authentication" in the supplicant configuration.

Re: NAC Policy for OS Boot vs Initial Boot

hslai — Sun, 12 Mar 2023 18:24:40 GMT

@network_geek1979 Adding to what ahollifield suggested...

Configuring 802.1x Authentication for Windows Deployment at A. Gross Blog might be of interest to you.