Access Control Concepts

Network Access Control Technologies

 

In theory, a MAC address is unique and unalterable and therefore a good

 

choice for identifying whether the endpoint should be allowed access. In

 

practice, however, an attacker can spoof a MAC address relatively easily.

 

If you are using IAS, you might encounter another problem. MAC addresses

 

do not conform to the rules for a typical user account. You must create an

 

entirely new set of pseudo-user accounts, which can be tedious and might

 

introduce security vulnerablities.

 

Despite its flaws, MAC-Auth remains the only choice for devices that have

 

neither user interfaces nor support for 802.1X.

 

 

N o t e

A device without a user interface may still support 802.1X. For example, many

 

Voice-over-IP (VoIP) phones support EAP-Subscriber Identity Module (SIM)

 

and include smart cards automatically configured with authentication creden-

 

tials. In addition, some Hewlett-Packard (HP) printers support 802.1X.

 

Process. An endpoint follows this process to connect to a network that

 

 

enforces MAC-Auth:

 

1. The endpoint connects to a PEP and begins generating traffic, typically

 

 

Dynamic Host Configuration Protocol (DHCP) requests.

 

2. The PEP observes that the traffic’s source MAC address is unauthenti-

 

 

cated, so it drops the traffic.

 

3.

The PEP generates an access request specifying the source MAC address

 

 

as the username, and, as the password, either the same MAC address or

 

 

a password configured on the PEP. The request also contains other

 

 

information, such as the port, time, and so forth. The PEP forwards the

 

 

request to an authentication server.

 

4. The authentication server, acting as the PDP, verifies the MAC address

 

 

against its own or a centrally managed data store. The authentication

 

 

server may also retrieve policy information, such as rules for the times

 

 

that the MAC address is allowed on the network or rules that specify

 

 

authorization instructions (for example, a VLAN assignment).

 

5.

The authentication server returns an accept or deny response to the PEP

 

 

that is based on the results of step 4.

6. The PEP reconfigures itself dynamically to forward or block all traffic from the MAC address depending on the access decision. If the accept response included authorization instructions, the PEP configures itself to enforce them—for example, assigning the endpoint’s port to the specified VLAN.

1-17