Back to Details

implementing-network-access-control

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Implementing Network Access Control

实现网络访问控制

When to Use

适用场景

  • Enforcing identity-based network access where only authenticated and compliant devices connect to the network
  • Implementing zero-trust networking at the access layer with dynamic VLAN assignment based on user role
  • Quarantining non-compliant devices that fail endpoint posture checks (missing patches, disabled AV)
  • Meeting compliance requirements (PCI-DSS, HIPAA, SOC 2) for network access controls
  • Onboarding BYOD devices with automated provisioning and limited network access
Do not use as a standalone security solution without complementary controls, for networks with devices that do not support 802.1X supplicants, or without proper fallback mechanisms for critical infrastructure.
  • 强制执行基于身份的网络访问，仅允许已认证且合规的设备接入网络
  • 在接入层落地零信任网络，基于用户角色实现动态VLAN分配
  • 隔离未通过终端姿态检查的不合规设备（如缺失补丁、防病毒软件未启用）
  • 满足网络访问控制相关的合规要求（PCI-DSS、HIPAA、SOC 2）
  • 通过自动化配置实现BYOD设备入网，并为其分配受限网络访问权限
禁用场景：缺乏配套控制措施时作为独立安全方案使用、网络中存在不支持802.1X Supplicant的设备、关键基础设施未配置合理的故障回退机制。

Prerequisites

前置要求

  • RADIUS server (FreeRADIUS, Microsoft NPS, or Cisco ISE) configured with user/device authentication
  • Managed switches supporting 802.1X port-based authentication
  • Certificate Authority for EAP-TLS certificate distribution (optional but recommended)
  • PacketFence or similar NAC platform for posture assessment and remediation
  • Active Directory or LDAP directory for centralized user authentication
  • DHCP server integration for dynamic IP assignment per VLAN
  • 已配置用户/设备认证的RADIUS服务器（FreeRADIUS、Microsoft NPS或Cisco ISE）
  • 支持802.1X基于端口认证的可管理交换机
  • 用于分发EAP-TLS证书的证书颁发机构（可选但推荐）
  • 用于姿态评估和修复的PacketFence或同类NAC平台
  • 用于集中式用户认证的Active Directory或LDAP目录服务
  • 集成DHCP服务器，实现按VLAN动态分配IP地址

Workflow

实施流程

Step 1: Install and Configure FreeRADIUS

步骤1：安装并配置FreeRADIUS

bash
undefined
bash
undefined

Install FreeRADIUS

Install FreeRADIUS

sudo apt install -y freeradius freeradius-utils freeradius-ldap
sudo apt install -y freeradius freeradius-utils freeradius-ldap

Configure RADIUS clients (switches that authenticate against RADIUS)

Configure RADIUS clients (switches that authenticate against RADIUS)

sudo tee /etc/freeradius/3.0/clients.conf << 'EOF' client switch-core-01 { ipaddr = 10.10.100.1 secret = R4d1u5_S3cr3t_K3y! shortname = core-switch nastype = cisco }
client switch-access-01 { ipaddr = 10.10.100.10 secret = R4d1u5_S3cr3t_K3y! shortname = access-switch-01 nastype = cisco }
client switch-access-02 { ipaddr = 10.10.100.11 secret = R4d1u5_S3cr3t_K3y! shortname = access-switch-02 nastype = cisco } EOF
sudo tee /etc/freeradius/3.0/clients.conf << 'EOF' client switch-core-01 { ipaddr = 10.10.100.1 secret = R4d1u5_S3cr3t_K3y! shortname = core-switch nastype = cisco }
client switch-access-01 { ipaddr = 10.10.100.10 secret = R4d1u5_S3cr3t_K3y! shortname = access-switch-01 nastype = cisco }
client switch-access-02 { ipaddr = 10.10.100.11 secret = R4d1u5_S3cr3t_K3y! shortname = access-switch-02 nastype = cisco } EOF

Configure LDAP module for Active Directory integration

Configure LDAP module for Active Directory integration

sudo tee /etc/freeradius/3.0/mods-available/ldap << 'EOF' ldap { server = 'ldap://dc01.corp.example.com' identity = 'CN=radius-svc,OU=Service Accounts,DC=corp,DC=example,DC=com' password = 'ServiceAccountPassword123!' base_dn = 'DC=corp,DC=example,DC=com'
user {
    base_dn = "${..base_dn}"
    filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})"
}

group {
    base_dn = "${..base_dn}"
    filter = "(objectClass=group)"
    membership_attribute = 'memberOf'
}
} EOF
sudo ln -s /etc/freeradius/3.0/mods-available/ldap /etc/freeradius/3.0/mods-enabled/ldap
undefined
sudo tee /etc/freeradius/3.0/mods-available/ldap << 'EOF' ldap { server = 'ldap://dc01.corp.example.com' identity = 'CN=radius-svc,OU=Service Accounts,DC=corp,DC=example,DC=com' password = 'ServiceAccountPassword123!' base_dn = 'DC=corp,DC=example,DC=com'
user {
    base_dn = "${..base_dn}"
    filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})"
}

group {
    base_dn = "${..base_dn}"
    filter = "(objectClass=group)"
    membership_attribute = 'memberOf'
}
} EOF
sudo ln -s /etc/freeradius/3.0/mods-available/ldap /etc/freeradius/3.0/mods-enabled/ldap
undefined

Step 2: Configure VLAN Assignment Policies

步骤2：配置VLAN分配策略

bash
undefined
bash
undefined

Configure authorization policies for dynamic VLAN assignment

Configure authorization policies for dynamic VLAN assignment

sudo tee /etc/freeradius/3.0/policy.d/vlan-assignment << 'EOF'
sudo tee /etc/freeradius/3.0/policy.d/vlan-assignment << 'EOF'

VLAN assignment based on group membership

VLAN assignment based on group membership

vlan_assignment { if (&LDAP-Group[] == "CN=IT-Staff,OU=Groups,DC=corp,DC=example,DC=com") { update reply { Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-ID = "10" } } elsif (&LDAP-Group[] == "CN=Developers,OU=Groups,DC=corp,DC=example,DC=com") { update reply { Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-ID = "15" } } elsif (&LDAP-Group[*] == "CN=Finance,OU=Groups,DC=corp,DC=example,DC=com") { update reply { Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-ID = "20" } } else { # Default: Guest VLAN for unknown users update reply { Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-ID = "40" } } } EOF
vlan_assignment { if (&LDAP-Group[] == "CN=IT-Staff,OU=Groups,DC=corp,DC=example,DC=com") { update reply { Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-ID = "10" } } elsif (&LDAP-Group[] == "CN=Developers,OU=Groups,DC=corp,DC=example,DC=com") { update reply { Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-ID = "15" } } elsif (&LDAP-Group[*] == "CN=Finance,OU=Groups,DC=corp,DC=example,DC=com") { update reply { Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-ID = "20" } } else { # Default: Guest VLAN for unknown users update reply { Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-ID = "40" } } } EOF

Add vlan_assignment to the authorize section

Add vlan_assignment to the authorize section

Edit /etc/freeradius/3.0/sites-enabled/default

Edit /etc/freeradius/3.0/sites-enabled/default

In the authorize section, add: vlan_assignment

In the authorize section, add: vlan_assignment

Configure EAP for 802.1X authentication

Configure EAP for 802.1X authentication

sudo tee /etc/freeradius/3.0/mods-available/eap << 'EAPEOF' eap { default_eap_type = peap timer_expire = 60 max_sessions = 4096
tls-config tls-common {
    private_key_file = /etc/freeradius/3.0/certs/server.key
    certificate_file = /etc/freeradius/3.0/certs/server.pem
    ca_file = /etc/freeradius/3.0/certs/ca.pem
    dh_file = /etc/freeradius/3.0/certs/dh
    cipher_list = "HIGH:!aNULL:!MD5"
    tls_min_version = "1.2"
}

peap {
    tls = tls-common
    default_eap_type = mschapv2
    virtual_server = inner-tunnel
}

tls {
    tls = tls-common
}
} EAPEOF
sudo tee /etc/freeradius/3.0/mods-available/eap << 'EAPEOF' eap { default_eap_type = peap timer_expire = 60 max_sessions = 4096
tls-config tls-common {
    private_key_file = /etc/freeradius/3.0/certs/server.key
    certificate_file = /etc/freeradius/3.0/certs/server.pem
    ca_file = /etc/freeradius/3.0/certs/ca.pem
    dh_file = /etc/freeradius/3.0/certs/dh
    cipher_list = "HIGH:!aNULL:!MD5"
    tls_min_version = "1.2"
}

peap {
    tls = tls-common
    default_eap_type = mschapv2
    virtual_server = inner-tunnel
}

tls {
    tls = tls-common
}
} EAPEOF

Start FreeRADIUS in debug mode for testing

Start FreeRADIUS in debug mode for testing

sudo freeradius -X
sudo freeradius -X

Test authentication

Test authentication

radtest testuser TestPassword123 localhost 0 testing123
undefined
radtest testuser TestPassword123 localhost 0 testing123
undefined

Step 3: Configure 802.1X on Cisco Switches

步骤3：在Cisco交换机上配置802.1X

! Enable AAA on the switch
enable
configure terminal

aaa new-model
aaa authentication dot1x default group radius
aaa authorization network default group radius
aaa accounting dot1x default start-stop group radius

! Configure RADIUS server
radius server FREERADIUS
  address ipv4 10.10.100.200 auth-port 1812 acct-port 1813
  key R4d1u5_S3cr3t_K3y!
  exit

! Enable 802.1X globally
dot1x system-auth-control

! Configure access ports for 802.1X
interface range GigabitEthernet1/0/1-24
  switchport mode access
  switchport access vlan 999
  authentication port-control auto
  authentication order dot1x mab
  authentication priority dot1x mab
  dot1x pae authenticator
  dot1x timeout tx-period 10
  mab
  authentication event fail action authorize vlan 999
  authentication event no-response action authorize vlan 40
  authentication host-mode multi-auth
  spanning-tree portfast
  exit

! Configure MAB (MAC Authentication Bypass) for devices without 802.1X
! Devices like printers, IP phones that cannot run a supplicant
interface range GigabitEthernet1/0/25-36
  switchport mode access
  switchport access vlan 999
  authentication port-control auto
  authentication order mab
  mab
  authentication event fail action authorize vlan 999
  authentication host-mode single-host
  spanning-tree portfast
  exit

! Configure guest VLAN for unauthenticated devices
interface range GigabitEthernet1/0/1-24
  authentication event no-response action authorize vlan 40
  authentication event fail action authorize vlan 999
  exit

! Configure critical VLAN for RADIUS server unavailability
interface range GigabitEthernet1/0/1-36
  authentication event server dead action authorize vlan 10
  authentication event server alive action reinitialize
  exit
! Enable AAA on the switch
enable
configure terminal

aaa new-model
aaa authentication dot1x default group radius
aaa authorization network default group radius
aaa accounting dot1x default start-stop group radius

! Configure RADIUS server
radius server FREERADIUS
  address ipv4 10.10.100.200 auth-port 1812 acct-port 1813
  key R4d1u5_S3cr3t_K3y!
  exit

! Enable 802.1X globally
dot1x system-auth-control

! Configure access ports for 802.1X
interface range GigabitEthernet1/0/1-24
  switchport mode access
  switchport access vlan 999
  authentication port-control auto
  authentication order dot1x mab
  authentication priority dot1x mab
  dot1x pae authenticator
  dot1x timeout tx-period 10
  mab
  authentication event fail action authorize vlan 999
  authentication event no-response action authorize vlan 40
  authentication host-mode multi-auth
  spanning-tree portfast
  exit

! Configure MAB (MAC Authentication Bypass) for devices without 802.1X
! Devices like printers, IP phones that cannot run a supplicant
interface range GigabitEthernet1/0/25-36
  switchport mode access
  switchport access vlan 999
  authentication port-control auto
  authentication order mab
  mab
  authentication event fail action authorize vlan 999
  authentication host-mode single-host
  spanning-tree portfast
  exit

! Configure guest VLAN for unauthenticated devices
interface range GigabitEthernet1/0/1-24
  authentication event no-response action authorize vlan 40
  authentication event fail action authorize vlan 999
  exit

! Configure critical VLAN for RADIUS server unavailability
interface range GigabitEthernet1/0/1-36
  authentication event server dead action authorize vlan 10
  authentication event server alive action reinitialize
  exit

Step 4: Deploy PacketFence NAC for Posture Assessment

步骤4：部署PacketFence NAC实现姿态评估

bash
undefined
bash
undefined

Install PacketFence

Install PacketFence

curl -fsSL https://inverse.ca/downloads/GPG_PUBLIC_KEY | sudo gpg --dearmor -o /etc/apt/keyrings/inverse.gpg echo "deb [signed-by=/etc/apt/keyrings/inverse.gpg] https://inverse.ca/downloads/PacketFence/debian bookworm bookworm" |
sudo tee /etc/apt/sources.list.d/packetfence.list sudo apt update && sudo apt install -y packetfence
curl -fsSL https://inverse.ca/downloads/GPG_PUBLIC_KEY | sudo gpg --dearmor -o /etc/apt/keyrings/inverse.gpg echo "deb [signed-by=/etc/apt/keyrings/inverse.gpg] https://inverse.ca/downloads/PacketFence/debian bookworm bookworm" |
sudo tee /etc/apt/sources.list.d/packetfence.list sudo apt update && sudo apt install -y packetfence

Run the PacketFence configurator

Run the PacketFence configurator

sudo /usr/local/pf/bin/pfcmd configreload
sudo /usr/local/pf/bin/pfcmd configreload

Access web admin: https://<packetfence-ip>:1443

Access web admin: https://<packetfence-ip>:1443

Configure PacketFence connection profiles

Configure PacketFence connection profiles

Admin UI: Configuration > Policies and Access Control > Connection Profiles

Admin UI: Configuration > Policies and Access Control > Connection Profiles

Create compliance check (Windows Update status)

Create compliance check (Windows Update status)

Admin UI: Configuration > Compliance > Scan Engines

Admin UI: Configuration > Compliance > Scan Engines

Add: Windows Update compliance check

Add: Windows Update compliance check

Remediation VLAN: 999 (quarantine)

Remediation VLAN: 999 (quarantine)

Configure RADIUS integration

Configure RADIUS integration

PacketFence acts as a RADIUS proxy, receiving requests from switches

PacketFence acts as a RADIUS proxy, receiving requests from switches

and enforcing posture-based VLAN assignment

and enforcing posture-based VLAN assignment

Edit /usr/local/pf/conf/switches.conf

Edit /usr/local/pf/conf/switches.conf

sudo tee -a /usr/local/pf/conf/switches.conf << 'EOF' [10.10.100.10] description=Access Switch 01 type=Cisco::Catalyst_2960 mode=production radiusSecret=R4d1u5_S3cr3t_K3y! SNMPVersion=2c SNMPCommunityRead=public SNMPCommunityWrite=private VlanMap=Y registrationVlan=40 isolationVlan=999 normalVlan=10 EOF
undefined
sudo tee -a /usr/local/pf/conf/switches.conf << 'EOF' [10.10.100.10] description=Access Switch 01 type=Cisco::Catalyst_2960 mode=production radiusSecret=R4d1u5_S3cr3t_K3y! SNMPVersion=2c SNMPCommunityRead=public SNMPCommunityWrite=private VlanMap=Y registrationVlan=40 isolationVlan=999 normalVlan=10 EOF
undefined

Step 5: Configure Supplicant on Endpoints

步骤5：配置终端的802.1X Supplicant

bash
undefined
bash
undefined

Windows Group Policy for 802.1X configuration

Windows Group Policy for 802.1X configuration

Computer Configuration > Policies > Windows Settings > Security Settings

Computer Configuration > Policies > Windows Settings > Security Settings

> System Services > Wired AutoConfig: Automatic

> System Services > Wired AutoConfig: Automatic

> Network Policies:

> Network Policies:

Authentication method: Microsoft: Protected EAP (PEAP)

Authentication method: Microsoft: Protected EAP (PEAP)

Inner method: EAP-MSCHAPv2

Inner method: EAP-MSCHAPv2

Trusted Root CA: Corporate CA

Trusted Root CA: Corporate CA

Linux 802.1X configuration with wpa_supplicant

Linux 802.1X configuration with wpa_supplicant

sudo tee /etc/wpa_supplicant/wpa_supplicant-wired.conf << 'EOF' ctrl_interface=/var/run/wpa_supplicant ap_scan=0
network={ key_mgmt=IEEE8021X eap=PEAP identity="testuser@corp.example.com" password="UserPassword123" ca_cert="/etc/ssl/certs/corporate-ca.pem" phase2="auth=MSCHAPV2" } EOF
sudo tee /etc/wpa_supplicant/wpa_supplicant-wired.conf << 'EOF' ctrl_interface=/var/run/wpa_supplicant ap_scan=0
network={ key_mgmt=IEEE8021X eap=PEAP identity="testuser@corp.example.com" password="UserPassword123" ca_cert="/etc/ssl/certs/corporate-ca.pem" phase2="auth=MSCHAPV2" } EOF

Start wpa_supplicant for wired 802.1X

Start wpa_supplicant for wired 802.1X

sudo wpa_supplicant -i eth0 -D wired -c /etc/wpa_supplicant/wpa_supplicant-wired.conf -B
sudo wpa_supplicant -i eth0 -D wired -c /etc/wpa_supplicant/wpa_supplicant-wired.conf -B

Verify authentication status

Verify authentication status

wpa_cli -i eth0 status
wpa_cli -i eth0 status

macOS: System Preferences > Network > Ethernet > 802.1X

macOS: System Preferences > Network > Ethernet > 802.1X

Configure with PEAP and corporate credentials

Configure with PEAP and corporate credentials

undefined
undefined

Step 6: Test and Validate NAC Deployment

步骤6：测试并验证NAC部署

bash
undefined
bash
undefined

Test 1: Authenticated device gets correct VLAN

Test 1: Authenticated device gets correct VLAN

Connect a corporate laptop with 802.1X configured

Connect a corporate laptop with 802.1X configured

Verify VLAN assignment on the switch:

Verify VLAN assignment on the switch:

show authentication sessions interface Gi1/0/1

show authentication sessions interface Gi1/0/1

Expected:

Expected:

Session ID: 0A0A0A01000000010001

Session ID: 0A0A0A01000000010001

Status: Authorized

Status: Authorized

Domain: DATA

Domain: DATA

Oper host mode: multi-auth

Oper host mode: multi-auth

Oper control dir: both

Oper control dir: both

Authorized By: Authentication Server

Authorized By: Authentication Server

Vlan Policy: 10

Vlan Policy: 10

Test 2: Unauthenticated device goes to guest VLAN

Test 2: Unauthenticated device goes to guest VLAN

Connect a device without 802.1X supplicant

Connect a device without 802.1X supplicant

show authentication sessions interface Gi1/0/2

show authentication sessions interface Gi1/0/2

Expected: Vlan Policy: 40 (Guest)

Expected: Vlan Policy: 40 (Guest)

Test 3: Failed authentication goes to quarantine

Test 3: Failed authentication goes to quarantine

Attempt authentication with wrong credentials

Attempt authentication with wrong credentials

Expected: Vlan Policy: 999 (Quarantine)

Expected: Vlan Policy: 999 (Quarantine)

Test 4: RADIUS server failure - critical VLAN

Test 4: RADIUS server failure - critical VLAN

Stop FreeRADIUS temporarily

Stop FreeRADIUS temporarily

Connect a new device

Connect a new device

Expected: Vlan Policy: 10 (Critical/failover)

Expected: Vlan Policy: 10 (Critical/failover)

Test 5: MAC Authentication Bypass

Test 5: MAC Authentication Bypass

Connect a printer (no supplicant)

Connect a printer (no supplicant)

MAB should authenticate based on MAC address in RADIUS

MAB should authenticate based on MAC address in RADIUS

show authentication sessions interface Gi1/0/25

show authentication sessions interface Gi1/0/25

Generate authentication report

Generate authentication report

show authentication sessions | include Auth

show authentication sessions | include Auth

show dot1x all summary

show dot1x all summary

undefined
undefined

Key Concepts

核心概念

TermDefinition
802.1XIEEE standard for port-based network access control that authenticates devices before granting network access via EAP and RADIUS
RADIUSRemote Authentication Dial-In User Service protocol used by network devices to authenticate users and receive authorization attributes (VLAN, ACL)
MAB (MAC Authentication Bypass)Fallback authentication method that uses a device's MAC address as credentials for devices that cannot run an 802.1X supplicant
EAP-PEAPProtected Extensible Authentication Protocol that wraps EAP in a TLS tunnel, commonly used with MSCHAPv2 for username/password authentication
Posture AssessmentEvaluation of endpoint compliance status (OS patches, antivirus, encryption) before granting full network access
Dynamic VLAN AssignmentRADIUS-driven automatic VLAN placement based on user identity, group membership, or device type, eliminating static port-based VLAN configuration
术语定义
802.1X基于端口的网络访问控制IEEE标准，通过EAP和RADIUS在授予网络访问权限前对设备进行认证
RADIUS远程认证拨号用户服务协议，网络设备通过该协议对用户进行认证，并获取授权属性（VLAN、ACL）
MAB (MAC Authentication Bypass)一种备用认证方法，针对无法运行802.1X Supplicant的设备，使用其MAC地址作为认证凭证
EAP-PEAP受保护可扩展认证协议，将EAP封装在TLS隧道中，通常与MSCHAPv2配合使用，实现用户名/密码认证
姿态评估在授予完整网络访问权限前，对终端合规状态（操作系统补丁、防病毒软件、加密情况）进行的评估
动态VLAN分配由RADIUS驱动的自动VLAN分配机制，基于用户身份、用户组成员身份或设备类型分配VLAN，无需基于端口的静态VLAN配置

Tools & Systems

工具与系统

  • FreeRADIUS: Open-source RADIUS server supporting EAP-TLS, PEAP, LDAP integration, and dynamic VLAN assignment
  • PacketFence: Open-source NAC solution providing 802.1X integration, posture assessment, captive portal, and device registration
  • Cisco ISE: Enterprise NAC platform with profiling, posture, guest management, and TrustSec integration
  • wpa_supplicant: Open-source 802.1X supplicant for Linux and embedded systems supporting EAP-TLS, PEAP, and TTLS
  • Microsoft NPS: Windows Server RADIUS implementation integrating natively with Active Directory for 802.1X authentication
  • FreeRADIUS：开源RADIUS服务器，支持EAP-TLS、PEAP、LDAP集成及动态VLAN分配
  • PacketFence：开源NAC解决方案，提供802.1X集成、姿态评估、强制门户及设备注册功能
  • Cisco ISE：企业级NAC平台，具备设备画像、姿态评估、访客管理及TrustSec集成能力
  • wpa_supplicant：面向Linux和嵌入式系统的开源802.1X Supplicant，支持EAP-TLS、PEAP和TTLS
  • Microsoft NPS：Windows Server的RADIUS实现，可与Active Directory原生集成，用于802.1X认证

Common Scenarios

常见场景

Scenario: Deploying 802.1X NAC in a Hospital Network

场景：在医院网络中部署802.1X NAC

Context: A hospital needs to enforce network access control to meet HIPAA requirements. The network includes clinical workstations (domain-joined), medical devices (no 802.1X support), physician BYOD devices, and guest WiFi. The deployment must not disrupt patient care if the RADIUS server becomes unavailable.
Approach:
  1. Deploy FreeRADIUS integrated with Active Directory for user authentication and group-based VLAN assignment
  2. Configure domain-joined workstations for EAP-PEAP via Group Policy with auto-enrollment
  3. Register medical devices (infusion pumps, monitors) for MAB authentication using their MAC addresses in the RADIUS database
  4. Configure switches with authentication order dot1x then mab, with critical VLAN fallback to the clinical VLAN if RADIUS is unreachable
  5. Deploy PacketFence captive portal for physician BYOD onboarding with limited-access VLAN
  6. Configure posture checks requiring Windows Update compliance and BitLocker encryption for full access
  7. Test failover scenarios by stopping RADIUS and verifying devices remain on critical VLAN without disruption
Pitfalls:
  • Not configuring critical VLAN fallback, causing devices to lose network access when RADIUS is unavailable
  • MAB MAC address databases becoming stale as medical devices are replaced or moved
  • 802.1X timeouts causing delays at workstation login, especially with slow RADIUS responses
  • Not testing multi-host mode on ports with IP phones and workstations daisy-chained
背景：某医院需要强制执行网络访问控制以满足HIPAA要求。其网络包含临床工作站（已加入域）、医疗设备（不支持802.1X）、医生BYOD设备及访客WiFi。部署方案必须确保在RADIUS服务器不可用时，不会影响患者诊疗工作。
实施方案：
  1. 部署与Active Directory集成的FreeRADIUS，实现用户认证和基于用户组的VLAN分配
  2. 通过组策略为已加入域的工作站配置EAP-PEAP，并启用自动注册
  3. 在RADIUS数据库中注册医疗设备（输液泵、监护仪）的MAC地址，用于MAB认证
  4. 配置交换机的认证顺序为dot1x优先、mab次之，同时配置关键VLAN回退机制，当RADIUS不可达时自动切换到临床VLAN
  5. 部署PacketFence强制门户，用于医生BYOD设备入网，并为其分配受限访问VLAN
  6. 配置姿态检查，要求设备满足Windows Update合规要求且启用BitLocker加密，才能获得完整网络访问权限
  7. 测试故障转移场景：停止RADIUS服务，验证设备仍保留在关键VLAN中，业务不受中断
常见陷阱：
  • 未配置关键VLAN回退机制，导致RADIUS不可用时设备失去网络访问权限
  • 随着医疗设备更换或迁移，MAB的MAC地址数据库会变得陈旧
  • 802.1X超时会导致工作站登录延迟，尤其是在RADIUS响应缓慢的情况下
  • 未在IP电话和工作站级联的端口上测试多主机模式

Output Format

输出格式

undefined
undefined

NAC Deployment Report

NAC Deployment Report

RADIUS Server: freeradius-01 (10.10.100.200) NAC Platform: PacketFence 13.1 Switches Configured: 12 access switches Total Ports: 576 access ports
RADIUS Server: freeradius-01 (10.10.100.200) NAC Platform: PacketFence 13.1 Switches Configured: 12 access switches Total Ports: 576 access ports

Authentication Summary (24-hour)

Authentication Summary (24-hour)

Auth TypeSuccessFailureTotal
802.1X (PEAP)34212354
MAB87390
Guest Portal23528
Auth TypeSuccessFailureTotal
802.1X (PEAP)34212354
MAB87390
Guest Portal23528

VLAN Assignment Distribution

VLAN Assignment Distribution

VLANNameAssigned Devices
10Corporate245
15Development67
20Finance30
40Guest23
50Medical Devices87
999Quarantine15 (posture fail)
VLANNameAssigned Devices
10Corporate245
15Development67
20Finance30
40Guest23
50Medical Devices87
999Quarantine15 (posture fail)

Compliance Status

Compliance Status

  • 802.1X coverage: 100% of access ports
  • Posture pass rate: 95.8% (15 devices quarantined for missing patches)
  • RADIUS failover tested: Successful (critical VLAN activated in 3 seconds)
undefined
  • 802.1X coverage: 100% of access ports
  • Posture pass rate: 95.8% (15 devices quarantined for missing patches)
  • RADIUS failover tested: Successful (critical VLAN activated in 3 seconds)
undefined