.

802.1x Cisco and AD

<<

scottr

Newbie
Newbie

Posts: 3

Joined: Thu Jan 08, 2009 1:59 pm

Post Thu Jan 15, 2009 9:57 am

802.1x Cisco and AD

How secure is 802.1x? Is it as easy to bypass as port security using mac addresses? Can you spoof the SID of a computer and join to the network or is there further verification that is done through the RADIUS server outside of just the machine or user SID? I am about to dig in and research this further but I figured this would be a great place to start.
Last edited by scottr on Mon Jan 19, 2009 4:11 pm, edited 1 time in total.
<<

dynamik

Recruiters
Recruiters

Posts: 1119

Joined: Sun Nov 09, 2008 11:00 am

Location: Mile High City

Post Thu Jan 15, 2009 11:19 am

Re: 802.1x Cisco and AD

What versions of Windows are you using?

Q. Is there a method to automate configuring 802.1X authentication settings for wired LANs for Windows XP or Windows Server 2003?

A. There is currently no method to automate the configuration of 802.1X settings for wired connections for clients running Windows XP or Windows Server 2003. The Wireless Network (IEEE 802.11) Policies Group Policy extension in Windows Server 2003-based Active Directory domains only applies to wireless connections.

Windows Vista and Windows Server 2008 support configuration of 802.1X settings for wired connections at the command line (through commands in the netsh lan context) and through Computer Configuration Group Policy.


http://www.microsoft.com/technet/networ ... edfaq.mspx

Depending on the number of machines you have, that could be a real hassle.

This article might give you some direction as well. It's focused on an early version of Server 2008, but it still has a lot of good information.
The day you stop learning is the day you start becoming obsolete.
<<

Chan

Newbie
Newbie

Posts: 32

Joined: Thu Jun 05, 2008 4:38 am

Post Thu Jan 15, 2009 2:17 pm

Re: 802.1x Cisco and AD

I think the "how secure is 802.1x" depends on how much 802.1x you're willing to implement, it's a bit of a broad standard from what I know.

You can require computer certificates, only available over an initial wired connection (if you're talking wireless) and a valid user cert once you've logged on before being dropped into the right valan etc all do-able with a 2k3 AD. Plus side of requiring both certs is you can revoke either :)

Yeah getting the initial comp cert could be a pain if you've got a huge amount of laptops to secure, but it only needs to be done once. I've seen it done with a couple of hundred machines in very little time.

This is all 802.1x for wireless connections, which seems fairly nails. - wired I've had no experience with.
CCNA, 100m Swimming cert.
<<

charlottebandit

Newbie
Newbie

Posts: 49

Joined: Sat Jun 10, 2006 4:26 pm

Post Wed Jan 21, 2009 11:56 pm

Re: 802.1x Cisco and AD

scottr wrote:How secure is 802.1x? Is it as easy to bypass as port security using mac addresses? Can you spoof the SID of a computer and join to the network or is there further verification that is done through the RADIUS server outside of just the machine or user SID? I am about to dig in and research this further but I figured this would be a great place to start.


802.1x provides excellent L/2 security for AAA services.  Depending on which authentication protocol you're using for 802.1x authentication (EAP-FAST, EAP-TLS) and RADIUS on the backend. 

It would be easier to install a keylogger than trying to spoof 802.1X credentials IMO as you would first have to be able to do a MITM attack through either ARP, DNS, DHCP, MAC, IP spoofing which can be blocked at the switch. 
MS, CCSP, CCNP, CCDP, CEH, CHFI, CPTS

Return to Hardware

Who is online

Users browsing this forum: No registered users and 1 guest

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software