topic Re: 802.1x machine authentication in Network Access Control

802.1x machine authentication

dhellmuth — Fri, 21 Feb 2020 18:11:29 GMT

Hi,

in an environment where we have a catalyst Switch, an ACS Server and a Win2000 or XP Client, is it possible to set up 802.1x machine authentication without client being part of a ADS ?

is it possible to do machine authentication only with certificates (EAP TLS) ?

Regards

Dirk

Re: 802.1x machine authentication

pcomeaux — Thu, 28 Oct 2004 01:50:43 GMT

Hey Dirk -

I've done machine authentication with 802.1x with ACS only. The switch determined the computer's name and sent it to the ACS server and the ACS server accepted the machine name and placed the port in the correct vlan.

I can't help with your 2nd question; hopefully someone else can address it.

thanks

peter

Re: 802.1x machine authentication

concue — Thu, 28 Oct 2004 11:30:03 GMT

Would you share your config.

Thanks,

Re: 802.1x machine authentication

jafrazie — Thu, 28 Oct 2004 13:09:11 GMT

I believe you're talking Active Directory, right?

Machine-Authentication is only achievable with an Active Directory backend.

Machine-Authentication is available fron EAP-TLS and PEAP with EAP-MSCHAPv2.

Hope this helps.

Re: 802.1x machine authentication

dhellmuth — Fri, 29 Oct 2004 05:00:35 GMT

Hi,

we've done some tests yesterday. For ACS without ADS machine authentication is just like a user authentication, someone provides his name and password/certificate. We created an user account on ACS named "host/" and ACS matched it when machine authentication was provides by the windows client.

But there were 2 problems:

- if we're using EAP-TLS, the certificate matching failed because ACS takes the machine name with a leading "host/" as the username and in the CN field of the certificate there is only the machine name.

- if we're using PEAP, we need a password for the ACS user account. The client provides a password that the ADS gave him. Where can i find that password ?

Any comments welcome

Regards

Dirk Hellmuth (CCSP)

CONET AG, Germany

Re: 802.1x machine authentication

jafrazie — Fri, 29 Oct 2004 05:34:40 GMT

Right:

That's why I was assuming you were using AD ;-). As for the password PEAP is using for machine-auth, it's the local system password from AD.

This should help further:

<http://download.microsoft.com/download/b/0/e/b0e2a363-0044-4327-8f17-020818f57234/Wired_depl.doc>

Hope this helps.