- Community Home
- >
- Networking
- >
- Switching and Routing
- >
- Aruba & ProVision-based
- >
- 802.1x PEAP/TLS with fallback to MAC based Auth if...
-
- Forums
-
- Advancing Life & Work
- Advantage EX
- Alliances
- Around the Storage Block
- HPE Ezmeral: Uncut
- OEM Solutions
- Servers & Systems: The Right Compute
- Tech Insights
- The Cloud Experience Everywhere
- HPE Blog, Austria, Germany & Switzerland
- Blog HPE, France
- HPE Blog, Italy
- HPE Blog, Japan
- HPE Blog, Middle East
- HPE Blog, Russia
- HPE Blog, Saudi Arabia
- HPE Blog, South Africa
- HPE Blog, UK & Ireland
-
Blogs
- Advancing Life & Work
- Advantage EX
- Alliances
- Around the Storage Block
- HPE Blog, Latin America
- HPE Blog, Middle East
- HPE Blog, Saudi Arabia
- HPE Blog, South Africa
- HPE Blog, UK & Ireland
- HPE Ezmeral: Uncut
- OEM Solutions
- Servers & Systems: The Right Compute
- Tech Insights
- The Cloud Experience Everywhere
-
Information
- Community
- Welcome
- Getting Started
- FAQ
- Ranking Overview
- Rules of Participation
- Tips and Tricks
- Resources
- Announcements
- Email us
- Feedback
- Information Libraries
- Integrated Systems
- Networking
- Servers
- Storage
- Other HPE Sites
- Support Center
- Aruba Airheads Community
- Enterprise.nxt
- HPE Dev Community
- Cloud28+ Community
- Marketplace
-
Forums
-
Blogs
-
Information
-
English
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
12-18-2015 02:29 AM
12-18-2015 02:29 AM
802.1x PEAP/TLS with fallback to MAC based Auth if first auth fails
Inclined readers,
Maybe I was just too stupid to find the correct document that describes the desired solution, so please don't flame me if it is obvious. However I found contradictionary results when googling, so I thought it to be the best idea to bring my issue to the community...
Our customer's requirements are:
•They want to use 802.1x authentication using PEAP/TLS on all Edge-Ethernet ports where possible
•For devices not supporting PEAP/TLS there should be an automatic fallback to MAC authentication also handled by the RADIUS server, so that there is no need to reconfigure the port if you connect a known 802.1x incapable device..
The environment consists of
1. Several 5406zl
2. Several 5406Rzl
3. A few 2920s
4. A few 2910s
THe document that contained the most information for me is
ftp://ftp.hp.com/pub/networking/software/2900yl-ASG-0207-T_12_XX-9-8021X.pdf
Quote:
Port-Based 802.1X can operate concurrently with Web-Authentication or
MAC-Authentication on the same port. However, this is not a commonly used
application and is not generally recommended.
In fact I don't want them to operate concurrently but only if EAP fails.
My questions are:
Is there any best practice way to do that on HP?
I have configured similar environments with switches from another vendor (by far not as prestigious as HP), so I think it'll not be impossible
If yes, could you point out the main steps? (I do not expect you guys to put together all the commands, just a very rough outline how to do it would be very nice)
If someone's got such a setup running, what is your experience with daily operations?
Thanks in advance for any piece of advice!
Greetings from Austria,
George
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
12-30-2015 05:37 AM
12-30-2015 05:37 AM
Re: 802.1x PEAP/TLS with fallback to MAC based Auth if first auth fails
Greetings George.
For me the best way to do 802.1x is based in MS-AD with NPS/NAP and Protectected EAP (PEAP) because you have all the user database in one place, you only need one certificate at the server side and at the network edge you just need switches that meet the open standards such as the HP ones either Commware or Provision based (I worked both with excellent results).
Attached you will find an example configuration file, it is a bit old Provision version but it worked fine.
Be sure to have your NPS/NAP services replicated in more than one server. If you want to do autovlan/QoS remember that you MUST work with MS-AD groups, not OU (even one do not interfere with the other)
Hope to helped you to find your way
Have a great New Year's Eve
Hewlett Packard Enterprise International
- Communities
- HPE Blogs and Forum
© Copyright 2021 Hewlett Packard Enterprise Development LP