|
|
 |
|||||||||||||||
|
|
|||||||||||||||
|
|||||||||||||||
|
|
 802.1X Port Access Control for WLANs By Lisa Phifer
September 5, 2003
Securing any kind of network involves allowing authorized parties to access traffic and networked resources (e.g., servers, hosts) while blocking outsiders. One essential ingredient in this recipe: permitting or denying physical attachment to the underlying communications medium. In Ethernet LANs, this has long been accomplished by disabling unused RJ-45 jacks and latching Media Access Control (MAC) addresses (define) to Ethernet switch ports. Early wireless LANs followed suit by using access control lists (ACLs) to permit associations by known MAC addresses while rejecting all others. MAC ACLs are quite easy to understand and configure. However, ACLs become difficult to manage in large/dynamic networks and are easily circumvented by network interface cards (NICs) with programmable addresses. Fortunately, there is a better answer: the LAN Port Access Control framework defined by the IEEE (define) 802.1X standard. This article explains the purpose of 802.1X and the role it can play in your network. Why LAN Port Access?MAC forgery is possible on wired and wireless LANs (WLANs), but the risk is greater on wireless. In a wired Ethernet, intruders can't easily learn valid MAC addresses. An unsupervised visitor might look at a PC's cable tag, plug his own laptop into the jack used by that PC, and reconfigure his NIC to impersonate the PC and gain access. But to pull this off, the intruder needs physical access to the facility and communications medium. In a WLAN, eavesdroppers within several hundred feet of an access point can use freeware sniffers to capture traffic. Even when data is encrypted for privacy, eavesdroppers can record MAC addresses from frame headers. A patient intruder can wait until later to reconfigure his NIC to impersonate a legitimate wireless station. An impatient intruder can reconfigure his NIC right away, send a disassociate request to kick the legitimate station off the air, then immediately reassociate with the access point. Such attacks don't require insider access to your facility -- intruders can be located in nearby parking lots, public hallways, stairways, bathrooms, or adjacent offices. More robust access control can benefit both wired and WLANs. Many companies also control access at the enterprise firewall or VPN gateway -- for example, permitting packets from known source IPs or prompting user login before permitting sessions through the firewall/gateway. Higher-layer controls are indeed very useful, but insufficient when used alone. For example:
Combining LAN access control with higher-layer controls can mitigate these kinds of threats. If an intruder can't send data through a LAN port, he can't request an IP address from DHCP or systematically guess IPs. If he can't receive data from an Ethernet port, he can't sniff peer traffic or hashed passwords. Unfortunately, one can't stop intruders from receiving or sending traffic over the air. However, port access control can stop intruders from sending traffic through the access point into adjacent networks. How 802.1X WorksThink of 802.1X as an ON/OFF gate inside Ethernet switches and wireless access points. This gate starts in the OFF position, handling only 802.1X requests until a decision is made to grant the station access. At that point, the gate is thrown into the ON position so that all LAN traffic can be relayed between the station and the upstream network. Eventually, the station times out or disconnects, throwing the gate back into the OFF position. 802.1X defines a management protocol that stations use to request LAN port access. It uses the Extensible Authentication Protocol (EAP) originally defined for dial-up, but here sent over Ethernet LANs (EAPOL) or over wireless (EAPOW). The station must first physically connect to the communications medium -- an Ethernet NIC plugs into a jack; a wireless NIC associates with an access point. The station then sends an "EAP Start" message. This kicks off a flurry of management messages that ends with "EAP Success" or "EAP Failure" (see Figure 1). So far, 802.1X sounds pretty simple, but here's where the real work happens. EAP is an envelope that can carry many different kinds of authentication -- challenge/response, one time passwords, SecurID tokens, digital certificates, etc. What happens between "EAP Start" and "EAP Success" depends upon the type of authentication being used.
|
||||||||||||||||||||||||||||||||||
The Network for Technology Professionals
Legal Notices, Licensing, Permissions, Privacy Policy.
Advertise | Newsletters | E-mail Offers
IE 7
Firefox 2.0
