Port Security Or 802.1X Authentication On Non-Server Network

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP











up vote
1
down vote

favorite












I have a closed network of 3 switches and 40 computers. 35 of those computers (Windows 7 x64 Professional) need to be plugged into any of the 24 ports on 2 of the switches at any time depending on the need and location of the user. I want to secure the switch to only allow these specific computers to connect. If another computer plugs in I want the switch to disable the port.



On previous small networks with no movement I configured each port with Port Security and the correct MAC Address of the computer. But for this I have more MACs than the Port Security table can handle. I was thinking about using 802.1X but I don't have a router on this system of which I am told I need for 802.1X. When I Google information for 802.1X configuration I end up with a lot of information on Wireless of which we don't use.



So my question is can I do 802.1X without a router and if so is there information on how to configure a server if needed? I have the switches setup with RADIUS authentication to access the SSH and console which works great.



Switches are HP ProCurve 2910al-24G.






mac-address hp-procurve authentication port-security radius







share|improve this question



























    up vote
    1
    down vote

    favorite












    I have a closed network of 3 switches and 40 computers. 35 of those computers (Windows 7 x64 Professional) need to be plugged into any of the 24 ports on 2 of the switches at any time depending on the need and location of the user. I want to secure the switch to only allow these specific computers to connect. If another computer plugs in I want the switch to disable the port.



    On previous small networks with no movement I configured each port with Port Security and the correct MAC Address of the computer. But for this I have more MACs than the Port Security table can handle. I was thinking about using 802.1X but I don't have a router on this system of which I am told I need for 802.1X. When I Google information for 802.1X configuration I end up with a lot of information on Wireless of which we don't use.



    So my question is can I do 802.1X without a router and if so is there information on how to configure a server if needed? I have the switches setup with RADIUS authentication to access the SSH and console which works great.



    Switches are HP ProCurve 2910al-24G.






    mac-address hp-procurve authentication port-security radius







    share|improve this question

























      up vote
      1
      down vote

      favorite









      up vote
      1
      down vote

      favorite











      I have a closed network of 3 switches and 40 computers. 35 of those computers (Windows 7 x64 Professional) need to be plugged into any of the 24 ports on 2 of the switches at any time depending on the need and location of the user. I want to secure the switch to only allow these specific computers to connect. If another computer plugs in I want the switch to disable the port.



      On previous small networks with no movement I configured each port with Port Security and the correct MAC Address of the computer. But for this I have more MACs than the Port Security table can handle. I was thinking about using 802.1X but I don't have a router on this system of which I am told I need for 802.1X. When I Google information for 802.1X configuration I end up with a lot of information on Wireless of which we don't use.



      So my question is can I do 802.1X without a router and if so is there information on how to configure a server if needed? I have the switches setup with RADIUS authentication to access the SSH and console which works great.



      Switches are HP ProCurve 2910al-24G.






      mac-address hp-procurve authentication port-security radius







      share|improve this question















      I have a closed network of 3 switches and 40 computers. 35 of those computers (Windows 7 x64 Professional) need to be plugged into any of the 24 ports on 2 of the switches at any time depending on the need and location of the user. I want to secure the switch to only allow these specific computers to connect. If another computer plugs in I want the switch to disable the port.



      On previous small networks with no movement I configured each port with Port Security and the correct MAC Address of the computer. But for this I have more MACs than the Port Security table can handle. I was thinking about using 802.1X but I don't have a router on this system of which I am told I need for 802.1X. When I Google information for 802.1X configuration I end up with a lot of information on Wireless of which we don't use.



      So my question is can I do 802.1X without a router and if so is there information on how to configure a server if needed? I have the switches setup with RADIUS authentication to access the SSH and console which works great.



      Switches are HP ProCurve 2910al-24G.






      mac-address hp-procurve authentication port-security radius




      mac-address hp-procurve authentication port-security radius






      share|improve this question















      share|improve this question













      share|improve this question




      share|improve this question








      edited 2 hours ago









      Zac67

      22.2k21250




      22.2k21250










      asked 3 hours ago









      JukEboX

      20519




      20519




















          1 Answer
          1






          active

          oldest

          votes

















          up vote
          3
          down vote













          The 2910al supports 802.1X port security as authenticator, using RADIUS over EAP or PEAP. Depending on your exact goals, an additional router is not required but you do need a RADIUS server. Check the 2910's "Access and Security Guide" chapter 13. If you've got nothing local to use as a RADIUS server you'll need a router to connect elsewhere - however, you can also set up something like a Raspberry Pi for RADIUS.



          MAC authentication is also possible in combination with RADIUS, see chapter 3. The 2910 can also use standalone Local MAC Authentication (LMA, chapter 4). I haven't done that yet and the manual doesn't list any table size restrictions, so you might need to give it a try.






          share|improve this answer




















            Your Answer







            StackExchange.ready(function()
            var channelOptions =
            tags: "".split(" "),
            id: "496"
            ;
            initTagRenderer("".split(" "), "".split(" "), channelOptions);

            StackExchange.using("externalEditor", function()
            // Have to fire editor after snippets, if snippets enabled
            if (StackExchange.settings.snippets.snippetsEnabled)
            StackExchange.using("snippets", function()
            createEditor();
            );

            else
            createEditor();

            );

            function createEditor()
            StackExchange.prepareEditor(
            heartbeatType: 'answer',
            convertImagesToLinks: false,
            noModals: false,
            showLowRepImageUploadWarning: true,
            reputationToPostImages: null,
            bindNavPrevention: true,
            postfix: "",
            noCode: true, onDemand: true,
            discardSelector: ".discard-answer"
            ,immediatelyShowMarkdownHelp:true
            );



            );













             

            draft saved


            draft discarded


















            StackExchange.ready(
            function ()
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fnetworkengineering.stackexchange.com%2fquestions%2f54326%2fport-security-or-802-1x-authentication-on-non-server-network%23new-answer', 'question_page');

            );

            Post as a guest

















            1 Answer
            1






            active

            oldest

            votes








            1 Answer
            1






            active

            oldest

            votes









            active

            oldest

            votes






            active

            oldest

            votes








            up vote
            3
            down vote













            The 2910al supports 802.1X port security as authenticator, using RADIUS over EAP or PEAP. Depending on your exact goals, an additional router is not required but you do need a RADIUS server. Check the 2910's "Access and Security Guide" chapter 13. If you've got nothing local to use as a RADIUS server you'll need a router to connect elsewhere - however, you can also set up something like a Raspberry Pi for RADIUS.



            MAC authentication is also possible in combination with RADIUS, see chapter 3. The 2910 can also use standalone Local MAC Authentication (LMA, chapter 4). I haven't done that yet and the manual doesn't list any table size restrictions, so you might need to give it a try.






            share|improve this answer
























              up vote
              3
              down vote













              The 2910al supports 802.1X port security as authenticator, using RADIUS over EAP or PEAP. Depending on your exact goals, an additional router is not required but you do need a RADIUS server. Check the 2910's "Access and Security Guide" chapter 13. If you've got nothing local to use as a RADIUS server you'll need a router to connect elsewhere - however, you can also set up something like a Raspberry Pi for RADIUS.



              MAC authentication is also possible in combination with RADIUS, see chapter 3. The 2910 can also use standalone Local MAC Authentication (LMA, chapter 4). I haven't done that yet and the manual doesn't list any table size restrictions, so you might need to give it a try.






              share|improve this answer






















                up vote
                3
                down vote










                up vote
                3
                down vote









                The 2910al supports 802.1X port security as authenticator, using RADIUS over EAP or PEAP. Depending on your exact goals, an additional router is not required but you do need a RADIUS server. Check the 2910's "Access and Security Guide" chapter 13. If you've got nothing local to use as a RADIUS server you'll need a router to connect elsewhere - however, you can also set up something like a Raspberry Pi for RADIUS.



                MAC authentication is also possible in combination with RADIUS, see chapter 3. The 2910 can also use standalone Local MAC Authentication (LMA, chapter 4). I haven't done that yet and the manual doesn't list any table size restrictions, so you might need to give it a try.






                share|improve this answer












                The 2910al supports 802.1X port security as authenticator, using RADIUS over EAP or PEAP. Depending on your exact goals, an additional router is not required but you do need a RADIUS server. Check the 2910's "Access and Security Guide" chapter 13. If you've got nothing local to use as a RADIUS server you'll need a router to connect elsewhere - however, you can also set up something like a Raspberry Pi for RADIUS.



                MAC authentication is also possible in combination with RADIUS, see chapter 3. The 2910 can also use standalone Local MAC Authentication (LMA, chapter 4). I haven't done that yet and the manual doesn't list any table size restrictions, so you might need to give it a try.







                share|improve this answer












                share|improve this answer



                share|improve this answer










                answered 2 hours ago









                Zac67

                22.2k21250




                22.2k21250



























                     

                    draft saved


                    draft discarded















































                     


                    draft saved


                    draft discarded














                    StackExchange.ready(
                    function ()
                    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fnetworkengineering.stackexchange.com%2fquestions%2f54326%2fport-security-or-802-1x-authentication-on-non-server-network%23new-answer', 'question_page');

                    );

                    Post as a guest
































































                    Comments

                    Post a Comment

                    Popular posts from this blog

                    What does second last employer means? [closed]

                    Image
                    Clash Royale CLAN TAG #URR8PPP .everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty margin-bottom:0; up vote -3 down vote favorite Say, for example I have worked in the following companies, Company A => 2010 - 2011 Company B => 2011 - 2012 Company C => 2012 - Till Date Company D => Have offer Now assume Company D is asking to submit documents from my second last employer. So from the list of companies given, which company would be qualified as second last employer? software-industry employer share | improve this question asked Aug 10 '14 at 5:16 Rajaprabhu Aravindasamy 559 1 6 13 closed as off-topic by Jim G., jmort253 ♦ Aug 11 '14 at 1:58 This question appears to be off-topic. The users who voted to close gave this specific reason: "Questions seeking advice on company-specific regulations, agreements, or policies should be directed to your manager or HR department. Questions that address...
                    Read more

                    List of Gilmore Girls characters

                    Image
                    The season three cast—(Back row): Lane, Michel, Paris, Emily, Richard, Sookie, Miss Patty, Kirk; Front row: Jess, Luke, Lorelai, Rory, Dean This is a list of characters for the comedy-drama television series Gilmore Girls . Contents 1 Main characters 1.1 Lorelai Gilmore 1.2 Rory Gilmore 1.3 Sookie St. James 1.4 Lane Kim 1.5 Michel Gerard 1.6 Luke Danes 1.7 Emily Gilmore 1.8 Richard Gilmore 1.9 Paris Geller 1.10 Dean Forester 1.11 Jess Mariano 1.12 Kirk Gleason 1.13 Jason Stiles 1.14 Logan Huntzberger 2 Major recurring characters 2.1 Christopher Hayden 2.2 Jackson Belleville 2.3 Mrs. Kim 2.4 Tristin DuGray 2.5 Max Medina 2.6 Taylor Doose 2.7 Dave Rygalski 2.8 Marty 3 Recurring characters 3.1 Stars Hollow 3.2 Chilton 3.3 Yale 3.4 Other 4 Notable guest stars 5 Unseen characters 6 Notes 7 References Main characters Actor Character Appearances Season 1 Season 2 Season 3 Season 4 Season 5 Season 6 Season 7 A Year in the Life Lauren Graham Lorelai Gilmore...
                    Read more

                    One-line joke

                    A one-liner is a joke that is delivered in a single line. A good one-liner is said to be pithy - concise and meaningful. [1] Comedians and actors use this comedic method as part of their act, e.g. Jimmy Carr, Tommy Cooper, Rodney Dangerfield, Norm Macdonald, Ken Dodd, Stewart Francis, Zach Galifianakis, Mitch Hedberg, Anthony Jeselnik, Milton Jones, Shappi Khorsandi, Jay London, Mark Linn-Baker, Demetri Martin, Groucho Marx, Dan Mintz, Emo Philips, Tim Vine, Steven Wright and Henny Youngman and Arnold Schwarzenegger. [ citation needed ] Many fictional characters are also known to deliver one-liners, including James Bond, who usually includes pithy and laconic quips after disposing of a villain. [ citation needed ] Examples "A baby seal walks into a club." "A dyslexic man walks into a bra." (Anonymous) "There are three types of people, those who can count and those who can't." "Venison's dear, isn't it?" (Jimmy Carr) "An escala...
                    Read more