802.11

Reference:
http://www.cs.wright.edu/~pmateti/InternetSecurity/Lectures/WirelessHacks/Mateti-WirelessHacks.htm
http://en.wikipedia.org/wiki/IEEE_802.11
http://www.informit.com/articles/article.aspx?p=413459
http://www.cisco.com/warp/public/cc/pd/witc/ao1200ap/prodlit/wswpf_wp.htm
http://xirrus.gcsmarket.com/posters/pdfs.asp

Secure Network Access

NAC stands for Network Access Control.
802.1X is the IEEE standard for port-based network access control.

NAC provides Endpoint security. The end point device can be a Laptop connected to a corporate network or a VPN client.
Depending on the security policy NAC will do user authentication, periodic health checks and policy enforcement.

-> User authentication can be by portal login, 802.1x etc.
-> Health check is done by a custom made Java applet, which runs on client, collect useful device information. Microsoft’s built-in NAP client also does the same job.
-> Policy enforcement, the most important part in a NAC, is done by SSCP, SSCPLite (Nortel proprietary), 802.1x etc.

=> NAC creates database with the information forwarded by NAC client. The policy decision is made based on corporate policy and database information. NAC server is also known as Policy Decision Point.

=> Policy enforcement point can be Switch, router, VPN gateway or firewall. Most commonly used access control techniques are VLAN segregation and packet filtering ACLs.

Future of NAC:
Some NAC policy servers are:
1. Cisco's Access Control Server (ACS)
2. Juniper's Unified Access Controller (UAC)
3. Microsoft's Network Policy Server (NPS)
4. Nortel's Secure Network Access (NSNA)
5. Trusted Computing Group's Trusted Network Connect (TNC)

IF-MAP is a standard client/server, XML-based SOAP, protocol for accessing a Metadata Access Point. The IF-MAP server has a database for storing information about network security events and objects (users, devices, etc.). The IF-MAP protocol defines a powerful publish/subscribe/search mechanism and an extensible set of identifiers, and data types.





=> Integrity measurements are carried between the TNC Client and TNC Server on a protocol called IF-TNCCS (Trusted Network Connect Client-Server).
=> For communication with NAP Client and NAP Server Microsoft used protocol called System of Health (SoH). Later donated to TCG as IF-TNCCS-SOH.

=> Consolidated IF-TNCCS enables Client-Server interoperability between NAP and TNC.
=> industry has agreed on TNC standard for NAC, except Cisco.

Reference:
White Paper - 1
http://features.techworld.com/networking/4073/microsoft-gets-nac-act-together
http://www.isp-planet.com/technology/2007/nac_3c.html
http://www.trustedcomputinggroup.org/developers/trusted_network_connect

802.1x

PPP is a data link protocol commonly used to establish a direct connection between two networking nodes.
PPP can provide connection authentication, transmission encryption privacy, and compression.

PPP -> alone provides username/password authentication (CHAP, PAP)
PPP + EAP -> Any type of authentication (EAP-MD5, PEAP)
PPP + EAP + RAS -> works fine
PPP + EAP + RAS + AAA -> RADIUS protocol takes care of the authentication
EAPOL + RAS + AAA -> 802.1x

L2TP and Microsoft’s secure RAS made PPP popular.
EAP is a universal authentication framework.
EAPOL is a standard for passing EAP over LAN.


802.1x is an IEEE standard for Port-Based Network Access Control.
802.1x works at Layer 2 to authentication and authorize devices on LAN switches and wireless APs.
It won’t work with multiple PC's connecting to a switch via a hub.

-> The user/client that wants to be authenticated is called a supplicant.
-> The actual server doing the authentication, typically a RADIUS server, is called the authentication server.
-> And the device in between, such as a wireless access point, is called the authenticator.



Benefits of IEEE 802.1X
1. Leverages existing standards EAP and RADIUS
2. Authentication based on Network Access Identifier and credentials
3. Centralized authentication, authorization, and accounting
4. Scalable through EAP types
5. Supports password authentication and One-Time Passwords (OTP)

Configure Freeradius:
/etc/raddb/clients.conf -> "client localhost { secret = testing }"
/etc/raddb/users -> "user1 User-Password := "pass1""
/sbin/radiusd -X
/bin/radtest user1 pass1 localhost 0 testing

Configure Switch (Nortel ERS 4550):
vlan members remove 1 1-11
vlan members add 16 1-11
vlan ports 12 tagging enable

radius-server host 192.168.10.254
radius-server key "testing"
radius-server port 1812

eapol enable
##EAPOL Administrative Status #> ENABLE
##EAPOL Administrative Status for ports #> Auto

Configure PC:
enable the following windows services:
-> Extensible Authentication Protocol Service
-> Wired AutoConfig / Wireless Zero Configuration

Local Area Connection properties -> Authentication -> Enable IEEE 802.1x authentication
Local Area Connection properties -> Authentication -> network auth method -> Protected EAP
Local Area Connection properties -> Authentication -> settings -> Authentication method -> EAP-MSCHAP v2


Reference:
http://www.javvin.com/protocol8021X.html
http://www.netcraftsmen.net/welcher/papers/dot1x.html
http://www.ipv6.com/articles/wireless/8021x-Wireless.htm
http://www.zyxeltech.de/SNotep335wt/app/8021x.htm
http://en.opensuse.org/RadiusServerHOWTO
http://www.ibm.com/developerworks/library/l-radius/