Re: Lock down LAN

Yes, you can do this, however you need more than just IAS -- you need to
install 802.1X authenticating switches as network access servers on your
LAN. When you use these switches and configure them as RADIUS clients to
the RADIUS server (IAS), users are authenticated and authorized before the
switch opens the port. Because of this, the client computer does not
receive an IP address until after the authentication process -- and if
authentication fails, the client computer does not receive an IP address
and the user cannot access the network.

As for deploying a Public Key Infrastructure (PKI) by installing and
deploying certificates with your own CA -- this works great, especially if
you use Group Policy and Cert services to autoenroll certificates to domain
member computers.

But if you have people accessing your LAN from home or other locations with
computers that are not domain members, it gets a little more complicated.

Here is a good whitepaper on how to set it all up:

"Deployment of IEEE 802.1X for Wired Networks Using Microsoft Windows" at
http://www.microsoft.com/downloads/details.aspx?FamilyID=05951071-6b20-
4cef-9939-47c397ffd3dd&DisplayLang=en

=?Utf-8?B?SHV0Y2g=?= <Hutch@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in
news:520C7153-37B0-4217-AE1A-3616620BCA65@xxxxxxxxxxxxx:

Hi All,

Not sure if I completely understand RADIUS, but from what I have read,
it appears that we can use it to lock down our LAN.

We have a number of branches, etc., none of which are overly secure.
Anyone could walk in, plug into our network, get an IP, and they are
off. What we would like to do, is put a RADIUS server online, that
would screen all such requests....if the computer in question does not
have a valid certificate, then no access.

In theory, I think this is possible. However, I don't have the first
clue on how to implement.

We are running a 2003 AD domain, with Exchange 2003, and have about
350+ users. All desktops are running Windows XP SP1 or higher. We
have a checkpoint firewall, for our internet access. All branches
come to a central location (main office) for AD authentication, IP
addressing, etc.

I am planning on setting up our own internal CA, so that would look
after the cert for RADIUS as well.

At some point in time, we may also want to setup wireless, but that is
not key at present.

Thanks,




--
James McIllece, Microsoft

Please do not send email directly to this alias. This is my online account
name for newsgroup participation only.

This posting is provided "AS IS" with no warranties, and confers no rights.
.

Relevant Pages

  • Re: IP address assignment problem
    ... I have a little problem and seek for ur thoughts, let's assume I'm in a very open environment where everyone can very easily try to get his/her laptop on the network and IP addresses are assigned by a DHCP server and we are in a domain environment, how do I prevent machines that are not part of our domain to be assigned an IP address? ... This approach doesn't stop your rogue clients from connecting to other clients, but merely doesn't give them the information they normally need to do so. ... Using 802.1x, your workstations authenticate through the switch to a radius server before they are allowed any connectivity. ... This authentication can use X.509 certificates, computer account credentials from AD, or whatever else you'd normally configure radius to authenticate with. ...
    (Focus-Microsoft)
  • Re: wireless network disconnects when using IEEE 802.1x authentica
    ... since it gets encrypted before it leaves the wireless NIC ... For a home network or small ... >> Change that authentication key say every six months. ... >> RADIUS server to do that, and it works best if you've got an Active ...
    (microsoft.public.windowsxp.security_admin)
  • PEAP Authentication in IAS
    ... I'm using a Procurve 2650 as Radius Client, ... Authentication in the network configuration of Windows XP and CHAP ...
    (microsoft.public.windows.server.active_directory)
  • Re: Securing a LAN
    ... > go out to the Internet. ... > an Ethernet network. ... I would like to add some authentication in this ... > IP to a certain MAC, but I heard something about RADIUS, that is a server ...
    (comp.os.linux.networking)
  • Cisco Security Advisory: RADIUS Authentication Bypass
    ... Cisco Security Advisory: RADIUS Authentication Bypass ... Cisco has made free software available to address this vulnerability. ...
    (Bugtraq)
Loading