Access Control

Question 1

Network Access Control (NAC)

Answer 1

• IEEE 802.1X - Port-based
  
  • Network Access Control (NAC)
  • You don’t get access until you authenticate

• Makes extensive use of EAP and RADIUS
• Extensible Authentication Protocol / Remote
Authentication Dial In User Service

• We’re talking about physical interfaces
  
  • Not TCP or UDP ports
• Administrative enable/disable
  
  • Disable your unused ports

• Duplicate MAC address checking - Stop the spoofers

Question 2

Port security

Answer 2

• Prevent unauthorized users from connecting
to a switch interface
• Alert or disable the port

• Based on the source MAC address
  
  • Even if forwarded from elsewhere
• Each port has its own config
  
  • Unique rules for every interface

Question 3

Port security operation

Answer 3

• Configure a maximum number of source MAC
addresses on an interface
• You decide how many is too many
• You can also configure specific MAC addresses

• The switch monitors the number of unique MAC
addresses
• Maintains a list of every source MAC address

• Once you exceed the maximum, port security
activates
• Default is to disable the interface

Question 4

MAC filtering

Answer 4

• Media Access Control - The “hardware” address

• Limit access through the physical hardware address
  
  • Keeps the neighbors out
  • Additional administration with visitors

• Easy to find working MAC addresses through wireless
LAN analysis
• MAC addresses can be spoofed
• Free open-source software

• Security through obscurity

Question 5

Captive portal

Answer 5

• Authentication to a network
  
  • Common on wireless networks
• Access table recognizes a lack of authentication
  
  • Redirects your web access to a captive portal page
• Username / password
  
  • And additional authentication factors

• Once proper authentication is provided, the web
session continues
• Until the captive portal removes your access

Question 6

Access Control Lists (ACLs)

Answer 6

• Used to allow or deny traffic
  
  • Also used for NAT, QoS, etc.
• Defined on the ingress or egress of an interface
  
  • Incoming or outgoing

• ACLs evaluate on certain criteria
• Source IP, Destination IP, TCP port numbers, UDP
port numbers, ICMP

• Deny or permit
  
  • What happens when an ACL matches the traffic?