Currently testing/piloting 802.1x on Catalyst 4506 and 2950 switches.
When setting a port for 802.1x and only to authenticate Single-Host, I notice that guest virtual machines (vmWare) running on a host machine are still able to pass traffic when the guest virtual machine is configured as a NAT-machine.
If the guest virtual machine is configured as a BRIDGED machine, which is usually default and the most common way people use virutal machines to participate on the network, then traffic is not passed. Only the host machine can pass traffic, which is the desired behavior.
But this does still does not remedy the situation in which someone has configured a virutal machine in NAT-mode, basically sharing the IP address of the host machine, "sitting behind the host machine". Like a router, or Internet Connection Sharing (a wonder if the same behavior would occur?).
Another thought, though...802.1x is working on layer 2 so why is this even an issue? The virtual machines do indeed have their own MAC addresses, so why is 802.1x failing and still allowing traffic to be passed on a port configured only for Single-Host?
Doesn't this pose a security risk for those trying to use 802.1x for network access management?
