802.1x machine authentication

[dhellmuth]

Hi,

in an environment where we have a catalyst Switch, an ACS Server and a Win2000 or XP Client, is it possible to set up 802.1x machine authentication without client being part of a ADS ?

is it possible to do machine authentication only with certificates (EAP TLS) ?

Regards

Dirk

[pcomeaux]

Hey Dirk -

I've done machine authentication with 802.1x with ACS only. The switch determined the computer's name and sent it to the ACS server and the ACS server accepted the machine name and placed the port in the correct vlan.

I can't help with your 2nd question; hopefully someone else can address it.

thanks

peter

[concue]

Would you share your config.

Thanks,

Bo

[jafrazie]

I believe you're talking Active Directory, right?

Machine-Authentication is only achievable with an Active Directory backend.

Machine-Authentication is available fron EAP-TLS and PEAP with EAP-MSCHAPv2.

Hope this helps.

[dhellmuth]

Hi,

we've done some tests yesterday. For ACS without ADS machine authentication is just like a user authentication, someone provides his name and password/certificate. We created an user account on ACS named "host/" and ACS matched it when machine authentication was provides by the windows client.

But there were 2 problems:

- if we're using EAP-TLS, the certificate matching failed because ACS takes the machine name with a leading "host/" as the username and in the CN field of the certificate there is only the machine name.

- if we're using PEAP, we need a password for the ACS user account. The client provides a password that the ADS gave him. Where can i find that password ?

Any comments welcome

Regards

Dirk Hellmuth (CCSP)

CONET AG, Germany

[jafrazie]

Right:

That's why I was assuming you were using AD ;-). As for the password PEAP is using for machine-auth, it's the local system password from AD.

This should help further:

<http://download.microsoft.com/download/b/0/e/b0e2a363-0044-4327-8f17-020818f57234/Wired_depl.doc>

Hope this helps.