Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In an 802.1X protected LAN, the switch port is usually set to "Multiple Hosts" mode and the access point is configured as an 802.1X supplicant which authenticates to the switch and "opens" the port. The access point can now freely bridge wireless clients to the LAN and has the responsibility of authenticating each wireless client.

This is insecure because you can unplug the LAN cable from the access point and plug it into a rogue switch along with the access point and the access point would authenticate and grant LAN access to the rogue switch where unauthorised devices can be connected.

Changing the switch port to "Multiple Sessions" mode will require all hosts to authenticate even if plugged into a rogue switch with the authenticated access point. If the Wi-Fi uses WPA2 Enterprise (802.1X based) as well, will this somehow authenticate the wireless clients to the switch so that they can access the LAN?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

I will start by saying that while some access points can be configured as a client to authenticate to an 802.1X protected switchport, not all can. Further, you can't enable 802.1X on a trunk/tagged port, so you won't be able to do this if you have an access point configured to handle multiple VLANs (i.e. multiple SSID/VLAN mappings with an autonomous AP or some vendors with 802.11ac are moving away from tunneling all traffic back to controllers).

I am not aware of an access point that will work in a "multiple session" mode as you describe. I think the first hurdle here is that the AP functions as a NAS itself, so the client is already authenticating to the network. This would potentially require a second 802.1X authentication by the client to the switch.

The second hurdle is that this would break any ability to run multiple SSIDs on different VLANs or to have the AP management IP address on a separate VLAN than the users. In a "multiple session" mode typically all devices must have the same VLAN assignment or they will be denied access.

Ultimately access points are part of your infrastructure and you should always look at physical security for all infrastructure. How are you securing your switch to switch links that are not participating in 802.1X? This is a security vulnerability as well if not secured properly.

For instance, I would start with some sort of cable locking device such as this one from Panduit. While not perfect, at less than $10 per AP it does make a cable much more difficult (either accidentally or from tampering) to remove without the "key" tool.

If you wanted more security I would use an enclosure to contain the AP and cabling. These will range from about $50-300 per location and provide differing levels of security (depending on make/model). If you go with a metal enclosure, you will need to use an external antenna to prevent the enclosure from interfering with signal, which may add additional costs.

share|improve this answer
    
Theoretically it could work on a Linux client by manually running wpa_supplicant twice - First using the wireless driver to authenticate to the AP and once the interface is up, again using the wired driver to authenticate to the switch. Obviously this is not feasible for regular clients unless the OS itself "detects" that the second Ethernet layer authentication is required after connecting to the AP. –  Locutus Jun 2 at 3:49
    
Also, this is just for a home lab. I am only interested in identifying solutions that are theoretically secure and that don't rely on physical security. If a device is physically compromised, the worst that could be done should be to have its settings erased and thus its saved credentials would be lost. My switch actually does support 802.1X on a trunk port as well as simultaneous VLAN assignment instead of trunking if the RADIUS server specifies the VLAN ID. I was eager to get this working with an AP that supports RADIUS based assignment on the same SSID. –  Locutus Jun 2 at 3:53
    
Not a Linux expert, so couldn't comment on running the supplicant twice. I find it hard to believe it would allow the use of the wired supplicant out the wireless interface though, and the AP as a NAS may intercept the exchange in any case. As for the trunk ports, I should clarify myself in that I am not aware of a AP/switch combination that does 802.1X in conjunction with trunk ports, although I could be wrong. You can do 802.1X on switch to switch trunk ports as long as the switches on both sides support this (which is not universal). –  YLearn Jun 2 at 18:30
    
Cisco supports 802.1X trunking with an AP as a supplicant with multiple SSIDs & VLANs right from their SMB 300 series switches and APs. –  Locutus Jun 3 at 6:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.