V-220675

Discussion

Controlling LAN access via 802.1x authentication can assist in preventing a malicious user from connecting an unauthorized PC to a switch port to inject or receive data from the network without detection.

Check Content

Verify if the switch configuration has 802.1x authentication implemented for all access switch ports connecting to LAN outlets (i.e., RJ-45 wall plates) or devices not located in the telecom room, wiring closets, or equipment rooms. MAC Authentication Bypass (MAB) must be configured on those switch ports connected to devices that do not support an 802.1x supplicant.

Step 1: Verify that 802.1x is configured on all host-facing interfaces as shown in the example below:

interface Ethernet1/1
 dot1x pae authenticator
 dot1x port-control auto
 dot1x host-mode single-host
 switchport access vlan 10

interface Ethernet1/2
 dot1x pae authenticator
 dot1x port-control auto
 dot1x host-mode single-host
 switchport access vlan 10

interface Ethernet1/3
 dot1x pae authenticator
 dot1x port-control auto
 dot1x host-mode single-host
 switchport access vlan 10

Note: Host-mode must be set to single-host, multi-domain (for VoIP phone + PC), or multi-auth (multiple PCs connected to a hub). Host-mode multi-host is not compliant with this requirement.

Step 2: Verify that 802.1x authentication is configured on the switch as shown in the example below:

aaa group server radius RADIUS_GROUP 
 server 1.1.1.1 
 server 1.2.1.1 
…
…
…
aaa authentication dot1x default group RADIUS_GROUP

Step 3: Verify that the radius servers have been defined.

radius-server host 10.1.1.1 key 7 "xxxxxxxxxxx" authentication accounting timeout 5 retransmit 1 
radius-server host 10.2.1.1 key 7 " xxxxxxxxxxx" authentication accounting timeout 5 retransmit 1

If 802.1x authentication or MAB is not configured on all access switch ports connecting to LAN outlets or devices not located in the telecom room, wiring closets, or equipment rooms, this is a finding.