802.1x on switch ports with NIC teaming enabled on host

[Ricky Sandhu]

Hi everyone,  I currently have NAC enabled on a switch running in monitor-mode (low-impact).  I have authentication open and a pre-auth ACL configured on the ports.  This pre-auth ACL only allows DHCP and gets overridden by a downloadable ACL from ISE upon successfully authentication.  The dACL is simply permit ip any any. This is working well with normal PCs on all ports.  Problem is with a host machine that's running multiple guests.  There are 4 access ports on the switch that connect to 4 separate NICs on this host.  On the server side, the 4 NICs are members of a team (switch independent).  Once I implement the pre-auth ACL on all 4 ports, all sorts of issues start happening.  From ping timeouts to complete connectivity loss with the guests.  I have authentication mac-move permit already configured on the switch.  Here is an example config from one of the ports followed by the pre-auth ACL syntax.

interface GigabitEthernet1/0/10
description Secure Access Port
switchport mode access
switchport nonegotiate
authentication event fail action next-method
authentication event server dead action authorize
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication open
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication violation restrict
mab
dot1x pae authenticator
dot1x timeout tx-period 10
spanning-tree portfast

!

ip access-list extended ACL-DEFAULT
permit udp any eq bootpc any eq bootps
permit udp any any eq domain
deny ip any any

!

Wondering if anyone has ever run into a similar issue?

[Colby LeMaire]

NIC teaming is something that is usually used with servers only and not for access devices.  Servers are usually located in a physically secure datacenter environment so 802.1x is not used on datacenter switches.  Depending on what software/hypervisor is used on this host, there may be configuration options within that host to ensure that virtual machines are dedicated to one physical link with another as a backup in case of failure.  But there are a lot of things that could be happening here.  Usually, the only time we see VMware or similar in a workstation situation is with developers and they have multiple VM's running on their workstation.  But they have only one physical link.  With bridged mode, you would have to use either multi-auth or multi-host mode on the switchport.  With NAT mode, you can authenticate the host OS and then the VM's are NAT'd to the same IP of the host.

Can you expand on what the host is running and what it is used for?

[Ricky Sandhu]

---

@Colby LeMaire wrote:

NIC teaming is something that is usually used with servers only and not for access devices.  Servers are usually located in a physically secure datacenter environment so 802.1x is not used on datacenter switches.  Depending on what software/hypervisor is used on this host, there may be configuration options within that host to ensure that virtual machines are dedicated to one physical link with another as a backup in case of failure.  But there are a lot of things that could be happening here.  Usually, the only time we see VMware or similar in a workstation situation is with developers and they have multiple VM's running on their workstation.  But they have only one physical link.  With bridged mode, you would have to use either multi-auth or multi-host mode on the switchport.  With NAT mode, you can authenticate the host OS and then the VM's are NAT'd to the same IP of the host.

Can you expand on what the host is running and what it is used for?

---

Hi Colby,  not configuring dot1x on switch ports facing the host is my last resort but I am hoping I don't have to do that.  We have over a 100 branch offices and a lot of them do not have the same type of security you would expect in a data center.  Most branch offices have a single host running Microsoft Hyper-V and several guests. 

[hslai · Accepted solution]

Microsoft Docs > Windows Server > Networking > NIC Teaming > Compatibility mentions 802.1X as a compatibility exception.

[Ricky Sandhu]

This would make sense however on the server side NIC teaming configuration is "switch independent".  This means server never really negotiates an etherchannel (LACP or otherwise) with the switch.  All 4 server NICs that are part of the team connect on individual access ports on the switch.  Server internally decides which ports to use as primary etc.  Only thing I can think of is that the switch might see MAC addresses bouncing between ports.  However I have MAC MOVE permitted.

[Colby LeMaire]

Are the guest OS's authenticating with 802.1x?  Or MAB?  Without the pre-auth ACL and auth open, then the switch will never block anything even if authentication is failing.  Once you apply a pre-auth ACL to limit connectivity, then traffic is blocked until a successful authentication and the dACL gets applied.  So, are the guests authenticating properly?  What do you see when you do a "show auth session int gx/y detail"?

On the server side, is there a way with your NIC Teaming configuration to control which physical interface is used for each guest OS?  I know with VMware, you can have it use one as a primary and not switch to another physical link unless the first one goes down.  That would minimize the amount of movement of the MAC addresses.  Because you have to realize that even if the OS's are authenticating correctly, every time the MAC moves to another port, the switch is blocking traffic for that IP until authentication is successful and the port ACL is updated with the dACL.  So there would be timeouts with pings if the MACs are moving around a lot.

You could try "authentication host-mode multi-host" where the host OS is authenticated first and then everything else is allowed after it.  Not sure how that would work since I am sure the host OS is using one physical NIC at a time.  But you can try it.

[Ricky Sandhu]

After spending a lot of time trying different methods to authenticate the VMs running on a Host machine,  I am giving up and moving ahead with this project without enabling 802.1x on switch ports directly connected to the host.  I ran some deep wireshark captures and noticed that the VMs seem to use a couple of different MAC addresses when they communicate and thus causing issues where the authenticator (switch) must authenticate the MAC address before allowing it access.