802.1x Installation problem with switch hp procurve

[Jeff Carrell]

manui31804 stated: "... error message read on the windows log"

The answer is in the error message:

Configuring passwords for reversible encrypted format to support EAP-MD5 is required due to the way passwords are handled using EAP-MD5 in Active Directory.

If you configure AD in this manner, this "new" setting will only apply for newly created passwords, so passwords from existing users arenâ t affected until their password gets changed/reset.

Note that this is a dangerous setting security wise, and in almost no production environment should this Password Policy Setting be enabled domain wide. It can also be set per user.

Reversible encryption is needed for the Web authentication and 802.1X CHAP (MD5), but NOT for the 802.1X authentication. In most production environments, only the user accounts that are used for Web authentication (for example guest accounts) should have â Store password using reversible encryptionâ set as well as those specific MD5 only systems (like the switch, sometimes VoIP phones).

This configuration can be used on a per user basis with the â Active Directory Users and Computersâ tool, under the â Accountâ tab of the userâ s properties.

As a note, W2K8 has the capability to have multiple "global" security polices, where you can have one policy support reversible password encryption and others that do not allow it...this is one of the major features that W2K0/3 do not offer.

hth...Jeff

[manui31804]

OK, i tried this solution.

I added a new OU which contains the switch supplicant. I added a GPO on this OU where i allowed reversibly encryption password. So i suppose it will only be applied on the switch supplicant. To be sure, i disabled this user, reseted his password and activated. I restarted the Switch then and the server but always same problem and same error message than my last post.

in attachment, a screen of what i did.

Thx for your explanations, i understood a lot of things.

My company uses windows 2003 servers so i have to test my solution on this kind of server and not on 2008. but it could be nice to try it after because it looks interesting.

Any idee or tests that i could do?

Thx

manu

[manui31804]

Yes it works !!
I tried to apply reversibly encrypted password directly on the swrad2 user and not as a gpo like i did before, and it worked.

Thx Oleg, Shadow and Jeff for you answers, i learned a lot thanks to you.

I have one more question(and last i hope):

When a user is connected on the supplicant switch, he doesn't need certificate, but if he's connected on the authenticator switch, the certificate is required.
I suppose it's due to the MD5 policy applied on the supplicant switch.
Is it possible to force user to use certificate when he's connected on a supplicant switch?

Thx for your answer, thx for all !

[Jeff Carrell]

glad it's working!!! happy to assist :-)

getting 802.1X to work is not "hard", but there are many components to make work together making it hard sometimes.

manui31804 asked: "Is it possible to force user to use certificate when he's connected on a supplicant switch?"

Yes, you should be able to configure the 2nd switch (supplicant configured switch) just like the 1st switch...define the 2nd switch as a RADIUS client, configure switch#2 with RADIUS and 802.1X support for the user ports, etc...

If the 2nd switch does not support 802.1X, then on the port on switch#1 that switch#2 connects to, define how many mac addresses you want it to allow (1-32) for 802.1X authentication and then when a new supplicant sends it's EAP traffic, switch#1 will simply forward that request through - but, when doing this, after the first user (switch#2 in this case) gets authenticated, then all subsequent users must assigned into the same VLAN as the switch#2 user is - you cannot have multiple authenticated users in different untagged VLANs on the same port - this is the value of the first option - each user gets separately authenticated and can be assigned their own VLAN id from RADIUS.

hth...Jeff


ps, I did a presentation 2 weeks ago at Sharkfest'10 on troubleshooting 802.1X titled: Network Access Security - It's Broken, Now What? the presentation is posted at:

http://www.cacetech.com/sharkfest.10/

in addition, many of the presentations done were video'd (including mine :-) see them at:

http://www.lovemytool.com/blog/2010/06/

[manui31804]

thx for your solutions, i'll try it and if problems, i'll come back to you.

Thx also for your presentation i will read this part in the week because 802.1X is really intersting.

regards

manu

[manui31804]

hi again !

we worked a lot on a other project so i just tried your solution yesterday.

My supplicant is correctly authenticated and my user just after so it's ok. But one more thing i forgot to ask:

Is it possible to authenticate the authenticator switch using MD5 like the supplicant ? cause i tried to do same configuration ( with reversible password ...) but not working for the authenticator so i just let it on a basic port (not radius port) to find if possible an other solution.

i was a little tired yesterday so maybe i did wrong but i would like to be sure.

Thx a lot for your answer.

PS: I saw your pdf presentation Jeff and i learned many more things. thx a lot ;)

manu

[Jeff Carrell]

manu said: "Is it possible to authenticate the authenticator switch using MD5 like the supplicant ? cause i tried to do same configuration ( with reversible password ...) but not working for the authenticator so i just let it on a basic port (not radius port) to find if possible an other solution.

i was a little tired yesterday so maybe i did wrong but i would like to be sure."

Yes, you must configure a uid/pw on the 2nd switch to it can pass that info up to the 1st switch port when the 1st switch send its radius-request message the port comes up.

Hope that makes sense.

Glad the info I provided was of value to you :-)

hth...Jeff

[manui31804]

sorry i forgot to answer.

Thx for all. all is working now thx to you ;).

Do you think 802.1x with wired network it's better to use 2008 server?

Because you told me there was the possibility to have multiple security policies. is there others advantages using 2008 server than 2003?

[Jeff Carrell]

manui31804 wrote: "Do you think 802.1x with wired network it's better to use 2008 server?

Because you told me there was the possibility to have multiple security policies. is there others advantages using 2008 server than 2003?"

W2K8-NPS has 2 resources to configure access control policies where W2K3-IAS only had one.

Now you get "connection policies" and "network policies" which provides more granular control of overall access policies - you can tune more directly where/how folks or devices authenticate on the network.

So that and more granular security policies makes W2K8 "way better" in my opinion.

glad I was able to help...Jeff