802.1x and MAC authentication on a single port

[grover75]

Hi

If you enable 802.1x and MAC authentication on a single port (Procurve 2610 switch), does it have to pass both authentication methods to get network access or can it pass either?

Thanks for your help

[Sietze Reitsma]

it can pass either.

so for example a phone authenticate with MAC auth and a client behind the phone with 802.1x. If the client authentication fails the phone is still authenticated.

You should not forget to raise the number of clients in your config which can authenticated on a single port.

[grover75]

Thanks

The plan was that when reinstalling a users PC we would initially use MAC authentication to complete the deployment then once the machine was on the domain and had its certificate we would switch to 802.1x certificate authentication. In testing when the certificate authentication is granted access and MAC authentication is denied, the MAC authentication appears to overide the former resulting in the PC being blocked from accessing the network. Is it possible to do this? am I missing something?

From the manual

Applying Web Authentication or MAC Authentication Concurrently
with Port-Based 802.1X Authentication: While 802.1X port-based access
control can operate concurrently with Web Authentication or MAC Authentication,
port-based access control is subordinate to Web-Auth and MAC-Auth
operation. If 802.1X operates in port-based mode and MAC or Web authentication
is enabled on the same port, any 802.1X authentication has no effect on
the ability of a client to access the controlled port. That is, the clientâ s access
will be denied until the client authenticates through Web-Auth or MAC-Auth
on the port. Note also that a client authenticating with port-based 802.1X does
not open the port in the same way that it would if Web-Auth or MAC-Auth were
not enabled. That is, any non-authenticating client attempting to access the
port after another client authenticates with port-based 802.1X would still have
to authenticate through Web-Auth or MAC-Auth.

[grover75]

Resolved the MAC authentication overriding the 802.1x authentication by changing the 802.1x authentication from port-based to user-based.

Cheers