2

In an 802.1X protected LAN, the switch port is usually set to "Multiple Hosts" mode and the access point is configured as an 802.1X supplicant which authenticates to the switch and "opens" the port. The access point can now freely bridge wireless clients to the LAN and has the responsibility of authenticating each wireless client.

This is insecure because you can unplug the LAN cable from the access point and plug it into a rogue switch along with the access point and the access point would authenticate and grant LAN access to the rogue switch where unauthorised devices can be connected.

Changing the switch port to "Multiple Sessions" mode will require all hosts to authenticate even if plugged into a rogue switch with the authenticated access point. If the Wi-Fi uses WPA2 Enterprise (802.1X based) as well, will this somehow authenticate the wireless clients to the switch so that they can access the LAN?

0

I will start by saying that while some access points can be configured as a client to authenticate to an 802.1X protected switchport, not all can. Further, you can't enable 802.1X on a trunk/tagged port, so you won't be able to do this if you have an access point configured to handle multiple VLANs (i.e. multiple SSID/VLAN mappings with an autonomous AP or some vendors with 802.11ac are moving away from tunneling all traffic back to controllers).

I am not aware of an access point that will work in a "multiple session" mode as you describe. I think the first hurdle here is that the AP functions as a NAS itself, so the client is already authenticating to the network. This would potentially require a second 802.1X authentication by the client to the switch.

The second hurdle is that this would break any ability to run multiple SSIDs on different VLANs or to have the AP management IP address on a separate VLAN than the users. In a "multiple session" mode typically all devices must have the same VLAN assignment or they will be denied access.

Ultimately access points are part of your infrastructure and you should always look at physical security for all infrastructure. How are you securing your switch to switch links that are not participating in 802.1X? This is a security vulnerability as well if not secured properly.

For instance, I would start with some sort of cable locking device such as this one from Panduit. While not perfect, at less than $10 per AP it does make a cable much more difficult (either accidentally or from tampering) to remove without the "key" tool.

If you wanted more security I would use an enclosure to contain the AP and cabling. These will range from about $50-300 per location and provide differing levels of security (depending on make/model). If you go with a metal enclosure, you will need to use an external antenna to prevent the enclosure from interfering with signal, which may add additional costs.

  • Not a Linux expert, so couldn't comment on running the supplicant twice. I find it hard to believe it would allow the use of the wired supplicant out the wireless interface though, and the AP as a NAS may intercept the exchange in any case. As for the trunk ports, I should clarify myself in that I am not aware of a AP/switch combination that does 802.1X in conjunction with trunk ports, although I could be wrong. You can do 802.1X on switch to switch trunk ports as long as the switches on both sides support this (which is not universal). – YLearn Jun 2 '14 at 18:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.