560 Configuring AAA for network users

NN47250-500 (Version 03.01)

Binding user authentication to machine authentication

Bonded Authentication™ (bonded authentication) is a security feature that binds an 802.1X user’s authentication to
authentication of the machine from which the user is attempting to log on. When this feature is enabled, WSS Software
authenticates a user only if the machine from which the user logs on has already been authenticated separately.
By default, WSS Software does not bind user authentication to machine authentication. A trusted user can log on from
any machine attached to the network.
You can use Bonded Authentication with Microsoft Windows clients that support separate 802.1X authentication for the
machine itself and for a user who uses the machine to log on to the network.
Network administrators sometimes use machine authentication in a Microsoft Active Directory domain to run login
scripts, and to control defaults, application access and updates, and so on. Bonded Authentication provides an added
security measure, by ensuring that a trusted user can log onto the network only from a trusted machine known to Active
Directory.
For example, if user bob.mycorp.com has a trusted laptop PC used for work but also has a personal laptop PC, you might
want to bind Bob’s authentication with the authentication of his workplace laptop, host/bob-laptop.mycorp.com. In this
case, Bob can log on to the company network only from his work laptop.
When Bonded Authentication is enabled, WSS Software retains information about the machine’s session when a user
logs on from that machine. WSS Software authenticates the user only if there has already been a successful machine
authentication. Evidence of the machine’s session in WSS Software indicates that the machine has successfully authenti-
cated and is therefore trusted by WSS Software. If WSS Software does not have session information for the machine,
WSS Software refuses to authenticate the user and does not allow the user onto the network from the unauthenticated
machine.

Authentication rule requirements

Bonded Authentication requires an 802.1X authentication rule for the machine itself, and a separate 802.1X authentica-
tion rule for the user(s). Use the bonded option in the user authentication rule, but not in the machine authentication rule.
The authentication rule for the machine must be higher up in the list of authentication rules than the authentication rule
for the user.
You must use 802.1X authentication rules. The 802.1X authentication rule for the machine must use pass-through as
the protocol. Nortel recommends that you also use pass-through for the user’s authentication rule.
The rule for the machine and the rule for the user must use a RADIUS server group as the method. (Generally, in a
Bonded Authentication configuration, the RADIUS servers will use a user database stored on an Active Directory
server.)
(For a configuration example, see “Bonded Authentication configuration example” on page 562.)
Note. If the 802.1X reauthentication parameter or the RADIUS Session-Timeout
parameter is applicable, the user must log in before the 802.1X reauthentication timeout or
the RADIUS session-timeout for the machine’s session expires. Normally, these
parameters apply only to clients that use dynamic WEP, or use WEP-40 or WEP-104
encryption with WPA or RSN.