How would you roll out 802.1X across a large campus without causing an outage?
Show the answer
Say this first
In phases. First monitor mode: the port runs 802.1X and MAB but lets all traffic through whatever the result, so I collect who passes and who fails without hurting anyone. Then low-impact mode: still open, but a pre-authentication port ACL allows only DHCP, DNS and boot services until a downloadable ACL from the server opens the rest. Closed mode only for areas that need it. Along the way I pick the right host mode, plan for RADIUS being unreachable with a critical VLAN, and enable change of authorization so the server can change a session's policy at any time.
Go deeper
The three phases
| Mode | Before or without auth | After success | Use |
|---|---|---|---|
| Monitor | everything (open authentication) | everything, now logged | discovery, fix supplicants, build MAB lists |
| Low impact | only what the pre-auth ACL allows | dACL from the server | most of the campus |
| Closed | EAPOL only | VLAN or dACL from the server | high-security areas |
interface GigabitEthernet1/0/10
ip access-group PRE-AUTH in
authentication open
authentication host-mode multi-auth
authentication order dot1x mab
authentication port-control auto
mab
dot1x pae authenticatorA downloadable ACL written with source any gets the client's own IP substituted, which needs the
switch's IP device tracking to know that IP.
Host modes
- single-host: one MAC per port, a second MAC is a violation.
- multi-host: the first MAC authenticates and the port opens for everyone behind it. Weak.
- multi-domain: one data device plus one voice device, the phone identified by the Cisco AV pair
device-traffic-class=voice. - multi-auth: every MAC authenticates on its own; one voice device plus many data devices.
When RADIUS is unreachable
interface GigabitEthernet1/0/10
authentication event server dead action authorize vlan 10
authentication event server alive action reinitializePlus radius-server dead-criteria and deadtime so the switch decides quickly that a server is down.
Change of authorization
RADIUS CoA (RFC 5176) lets the server reauthenticate, bounce or end a session, which posture checks,
profiling updates and quarantine all rely on. On the switch: aaa server radius dynamic-author with
the server as a client.
On current IOS-XE the same features are expressed in the newer policy style (IBNS 2.0) with
access-session commands and control policies, and authentication convert-to new-style migrates.
They will ask next
How do you keep Wake-on-LAN working on unauthorized ports?
authentication control-direction inblocks only traffic coming from the unauthorized client and still lets traffic out to it, so the magic packet reaches a sleeping PC.What do you watch during the monitor phase?
Failure reasons on the RADIUS server grouped by switch and by cause: missing supplicant settings, expired or untrusted certificates, unknown MACs. Do not move a closet to low impact until its failure list is empty or understood.
Traps
- Going straight to closed mode. The first failed printer becomes the whole project's reputation.
- Treating multi-host as secure. One authenticated device opens the port for everything behind it.
- Having no plan for a RADIUS outage, which turns a server problem into a campus outage.