Deploying 802.1x Dynamic VLAN authentication for Wired Networks using Cisco ACS 4.2 and Microsoft IAS Radius Servers (Part 2)

In part1 of our Deploying 802.1x Dynamic VLAN authentication for Wired Networks using Cisco ACS 4.2 and Microsoft IAS Radius Servers. We have discussed about setting up the AD security groups and Certificate Infrastructure. We also discussed setting up our RADIUS servers and policies for authentication and VLAN allocation. Now we will discuss configuring the AAA clients which in our scenario right now are Cisco Switches that will be performing 802.1x port authentication by passing Machine credentials to the defined RADIUS servers.

Defining AAA clients on RADIUS servers

Next step in our setup is to define our AAA clients on the RADIUS servers, it involves simply pointing the AAA client's IP on the network and a preshared key that will later be defined on the switch as well. Once you are done you will have a screen similar below.

Configure Authenticating Switches

Now its time for us to configure our Cisco Switches to pass authentication to RADIUS servers and perform per port 802.1x authentication to connecting end devices. You should have a bunch of global commands instructing the switch to perform 802.1x authentication similar to the one below. You can go to Cisco's website to get more information on the commands although I will try to comment on some of the lines.

aaa authentication
dot1x default group radius
aaa authorization network default group radius
aaa accounting dot1x default start-stop group radius
aaa accounting system default start-stop group radius
dot1x system-auth-control ( define this to see Dot1x commands per interface level )

ip radius source-interface value
radius-server host x.x.x.x auth-port 1645 acct-port 1646 timeout value key value
radius-server host x.x.x.x auth-port 1645 acct-port 1646 timeout value key value

The next 3 commands above instructs the switch where the source RADIUS server's VLAN is located when you have multiple VLANs and also points the RADIUS server hosts. The primary will be the first one defined and secondary will be the second one. The key value is the same pre-shared key used when you define your AAA client on the RADIUS servers.

Once you have these commands set, its time to go per port level and allow switch ports to do dot1x authentication.

switchport access vlan id
switchport mode access
dot1x pae authenticator
dot1x port-control auto
dot1x host-mode multi-domain
dot1x timeout tx-period value
dot1x auth-fail vlan id
dot1x guest-vlan id
spanning-tree portfast

You can lookup this commands further but basically on this configuration for the guest-vlan and auth-fail vlan, you are configuring where clients will be dumped to if they fail dot1x authentication with the RADIUS servers.

Configure wired client computers for PEAP-MS-CHAP v2 802.1x authentication

Ok now we almost have everything set, the last set is to configure our Dot1x clients which are Windows XP machines in this example. Basically what we need to do is to configure the clients NIC card to perform Dot1x authentication. You can research about GPO policy extension to set this one for the clients but I believe at the time of this writing it is only available in Windows Vista and a Windows 2008 Domain Controller. Just follow the screen below and you should have configured your clients appropriately.

Note that I have cleared the screencap, if the environment is more restrictive, you can define the value of the "Connect to these Servers" field on the client's NIC card. This prevents man in the middle attacks when you are doing the dot1x authentication to your RADIUS servers. Do note that if you are configuring a Windows XP SP3 client note the changes in configuring Dot1x for the network card in this kb article "Changes to the 802.1X-based wired network connection settings in Windows XP Service Pack 3"

http://support.microsoft.com/kb/949984

Also there are two registry values that you would likely change to control supplicant behavior on the clients. The first one defines that you are performing only Machine Authentication and the second one allows the supplicant client to send stop and start messages for Dot1x. Based on experience, you should set the second registry value as listed below as I have found that some clients do not get authenticated if this value is not set.

HKEY_LOCAL_MACHINE\Software\Microsoft\EAPOL\Parameters\General\Global\AuthMode=2

HKEY_LOCAL_MACHINE\Software\Microsoft\EAPOL\Parameters\General\Global\SupplicantMode registry value to 3 (REG_DWORD data type). The default value of SupplicantMode for wired connections is 2.

Verify Wired Connections

Now that you have done configuring your dot1x clients. Verify that you can authenticate to your RADIUS servers and get your VLAN assignment based on your grouping. You can move the clients to another AD security group and test the new VLAN segment once you unplug and replug the network cable for the machine. Lastly I need to mention that for Cisco ACS you may need to install this hotfix on your Windows Dot1x clients as the Windows clients don't work well by default with 3rd party RADIUS servers for PEAP see "PEAP authentication is not successful when you connect to a third-party RADIUS server" on kb http://support.microsoft.com/kb/885453

Before I forget here are the links you can use as reference for your own deployment:

Microsoft:

http://www.microsoft.com/DOWNLOADS/details.aspx?familyid=05951071-6B20-4CEF-9939-47C397FFD3DD&displaylang=en

http://www.microsoft.com/downloads/details.aspx?FamilyID=c9ed3609-49fc-439b-92f4-266b187cae5a&displaylang=en

Cisco:

http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a0080921f67.shtml

http://www.ciscopress.com/articles/article.asp?p=29600&seqNum=3

http://www.ciscosystems.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.1/user/ACSugP.pdf

Hope you guys enjoyed this article. Do comment for additional info or corrections.

Deploying 802.1x Dynamic VLAN authentication for Wired Networks using Cisco ACS 4.2 and Microsoft IAS Radius Servers (Part 1)

Today I am sharing a deployment of 802.1x Dynamic VLAN Authentication for Wired Networks using Cisco's ACS and Microsoft IAS RADIUS Servers. If you are using Microsoft Operating Systems as clients such as Windows XP and Vista machines, two common 802.1x authentication methods that will be supported for use based on Extensible Authentication Protocol (EAP) are EAP-TLS or PEAP-MS-CHAP v2.
.

For this deployment we will be using PEAP-MS-CHAP v2 as the authentication method between our clients and RADIUS servers. You can read about the difference between the two methods but PEAP-MS-CHAP v2 is the preferred method for its effectiveness and lesser administrative overhead. (EAP-TLS requires you to install user certificates aside from computer certificates as well) Another least known authentication method is EAP-MD5 CHAP but it is lessed widely used in 802.1x deployments.

..

As usual let me outline what is needed for our deployment scenario:

• Configure Active Directory for accounts and groups
• Configure a certificate infrastructure for PEAP-MS-CHAP v2
• Configure the RADIUS servers and Policies
• Deploy and configure authenticating switches as AAA clients defined on our RADIUS servers
  Configure wired client computers for PEAP-MS-CHAP v2 802.1x authentication
  Verify Wired Connections

Caveats when doing Dynamic VLAN authentication with Windows

Before we start I would like to mention that if you are doing this deployment setup, you have to be aware that when doing Dynamic VLAN authentication, your group policies and logon scripts may fail to work if you are performing both Computer and User authentication. The reason I say this is that a Machine doing computer authentication will get an IP address during the bootup process after it has authenticated. Now let us say that you are implementing User authentication as well, if it happens that the user should belong to another VLAN based on your policy, it will trigger a change in VLAN segment during the logon process simultaneously while your logon scripts and GPO are being processed the scripts to fail. Currently this is documented in KB article 935638. http://support.microsoft.com/kb/935638

.

For this reason if you plan to implement Dynamic VLAN with both Computer and User authentication, you should consider investing in a third party supplicant such as Cisco's Secure Client. I will not be dealing with Cisco's Secure Client for this post but once you see how the native MS supplicant is setup you should be able to configure Cisco's Secure Client as well.

.

Configure Active Directory for accounts and groups
.

Ok we are assuming that you already have Active Directory already in place in your environment. With this you could already provision your AD security groups containing Computer Accounts and User Accounts that you would wish to group to a particular VLAN.

.

Configure a certificate infrastructure for PEAP-MS-CHAP v2
.

Next step is to configure a Certificate Infrastructure, you may opt to use Internal Microsoft Certificate Authority, but I do need to mention that you should select an Enterprise Edition of Windows Server if you are using Cisco's ACS for your deployment, ACS requires a duplication of a V2 certificate template which will only be available on Enterprise Edition of Windows. Read my previous post here. Later I will be providing a listing of related links that you can use to start your deployment.

.

Configure the RADIUS servers
.

I will not be dealing with setting up ACS but instead you can read othe guides I will be providing at the end of the article. In this setup we will have ACS as our primary RADIUS server and IAS as the secondary RADIUS server. For IAS, you can proceed with ADD/REMOVE Windows Component on your server and enable the Internet Authentication Service component. Need to note that is recommended to have your RADIUS running on probably one of your Domain Controllers for faster authentication. Once you have IAS running, you would like request for a Server Certificate to support your PEAP infrastructure. Main thing to note is that PEAP only requires a Machine Server Certificate on your IAS server and your authenticating clients only need to have a trusted root certificate of the issuing CA of your RADIUS servers. This simplicity also makes PEAP a favorable choice over EAP-TLS. Ok I have been talking a lot regarding the deployment and now its time for some screenshots.

Ok I have cleared some of the details on the screencap as this represents my actual deployment for one client, two things you need to note is that PEAP certificate field should contain your IAS Server Certificate. If you are using a Domain Controller installed with IAS service, then you will probably have the Domain Controller Certificate already ready to use. This will do as long as the certificate has the Server Authentication key usage attribute. You can check this when you open the certificate and check details tab for the Enhanced Key Usage attribute. For the edit profile tab, the advanced tab is where you configure the policy for Dynamic VLAN. This tells you exactly where to place the machine when it is authenticated. The Tunnel-PVT-Group-ID will actually correspond to your VLAN NAME defined on the switch (case sensitive) and the Tunnel Tag corresponds the VLAN number. After defining our policies we can proceed with configuring the AAA client switches in part2 of our article.