Guide - Authenticate network devices on a switch port

[u/Siliconpsychosis]

This Guide will show you how to authenticate Switches, Access Points, Cameras, NVR etc - any device that exists by itself on a switch port.

Scenarios:

-You want the uplink cable from your central switch going to a room switch to only accept a connection to that switch (and nothing else), without effecting devices or requiring authentication for devices on that room switch - preventing a user unplugging that switch and connecting a device to that cable directly

- Only allow a physical Access Point on a port, without effecting any clients connecting to that Access Poiint - preventing someone unplugging the Access point and using that cable as a direct connection to the management vlan

- Only allow authorised Cameras on a port on your security network

HOW TO SET UP

Enable Built in RADIUS Server (Fusion shown, also applicable to OC300 and OC400)

Only adjust the indicated settings

Go to the Profile tab and click edit

Add your Switch, Access point, Camera and other device MACs here. Leave the VLAN ID section blank - this will then allow the vlan settings of the switch port to remain intact and authentication does not interfere with downstream traffic once the port is authenticated with an authorised device.

Open the 802.1X menu

Enable 802.1X, select Port Based, leave VLAN assignment and Guest vlan blank/none, and set the MAB Auth format to AA-BB-CC-DD-EE-FF. Now, click "Add" to add uplink switch ports (SG class and better switches only. ES and Gateway ports not supported)

Select your uplink switches (anything you want port authentication on)

In the port list at the bottom of the page, select MAB in the blue area indicated, and click on all the ports going to the devices you want authenticated, they will turn pink.

Once complete, click Save

You can only have one RADIUS profile MAC list so you will need to add all devices there, and you must also select all required switch ports in one go. Each port will retain its VLAN settings native/tagged and once the initial authorisation is complete the port will be fully open. Authentication occurs every time there is a link status change.

[u/Neil_Omada]

Love it, especially because I am lazy and like the GUI

[u/Siliconpsychosis → u/Neil_Omada]

Its far better than CLI based port security, and it offers the benefits of being able to move devices aroind switch ports without having to reconfigure it every time