stop DHCP using radius server

[Hisoma Sama]

hello

I have a network4500x as a cores and 2960 as access switches, i want to stop who's not joining domain Microsoft active directory from getting IP, im aware that ISE have the ability to do that, but for now im using microsof NPS Radius server since its free.

so im looking for the commands that i should apply to stop DHCP for visitors/guests.

and should it be on both core and access SW's or just on the core

thanks in advance

[balaji.bandi]

You have limitation here :

1. IP address come First

2. then you have AD login information.

So you need to have mechanish in place detect the known clients to give DHCP IP address.

that only happends when you have some Identity system in place..

If you keen to put some time 

try

https://packetfence.org/

[Deepak Kumar]

Hi,

You can configure the 802.1x authentication with Radius server on the switch. first, it will authenticate the system before alow the DHCP.

Here are the Guide and Configuration guide on the same.

https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Security/TrustSec_1-99/Dot1X_Deployment/Dot1x_Dep_Guide.pdf

Global Configuration:

! Define a RADIUS server
radius-server host x.x.x.x
radius-server key xxxxxxx
! Configure 802.1X to authenticate via AAA
aaa new-model
aaa authentication dot1x default group radius
! Enable 802.1X authentication globally
dot1x system-auth-control

Interface Configuration
! Static access mode
switchport mode access
! Enable 802.1X authentication per port
dot1x port-control auto
! Configure host mode (single or multi)
dot1x host-mode single-host
! Configure maximum authentication attempts
dot1x max-reauth-req
! Enable periodic reauthentication
dot1x reauthentication
! Configure a guest VLAN
dot1x guest-vlan 123
! Configure a restricted VLAN
dot1x auth-fail vlan 456
dot1x auth-fail max-attempts 3

Regards,

Deepak Kumar

[balaji.bandi]

+1 @Deepak Kumar 

yes you can consider this solution, i am not sure orginal post user have CA/PKI infrastructure in place..