implementing-network-access-control

实施网络访问控制

何时使用

• 在只有经过身份验证且合规的设备才能连接网络的环境中，实施基于身份的网络访问控制
• 在接入层实施零信任网络，并根据用户角色动态分配 VLAN
• 隔离未通过端点合规性检查（缺少补丁、杀毒软件被禁用）的不合规设备
• 满足网络访问控制方面的合规要求（PCI-DSS、HIPAA、SOC 2）
• 通过自动化配置和受限网络访问来接入 BYOD 设备

不要在没有配套控制措施的情况下将其作为独立安全解决方案使用，不要用于包含不支持 802.1X 客户端的设备的网络，也不要在没有为关键基础设施提供适当回退机制的情况下使用。

前提条件

• 已配置用户/设备身份验证的 RADIUS 服务（FreeRADIUS、Microsoft NPS 或 Cisco ISE）
• 支持 802.1X 基于端口身份验证的受管交换机
• 用于分发 EAP-TLS 证书的证书颁发机构（可选，但推荐）
• PacketFence 或类似的 NAC 平台，用于合规性评估和修复
• 用于集中式用户身份验证的 Active Directory 或 LDAP 目录
• 与 DHCP 服务集成，以便按 VLAN 动态分配 IP

工作流

步骤 1：安装并配置 FreeRADIUS

# Install FreeRADIUS
sudo apt install -y freeradius freeradius-utils freeradius-ldap

# Configure RADIUS clients (switches that authenticate against RADIUS)
sudo tee /etc/freeradius/3.0/clients.conf << 'EOF'
client switch-core-01 {
    ipaddr = 10.10.100.1
    secret = R4d1u5_S3cr3t_K3y!
    shortname = core-switch
    nastype = cisco
}

client switch-access-01 {
    ipaddr = 10.10.100.10
    secret = R4d1u5_S3cr3t_K3y!
    shortname = access-switch-01
    nastype = cisco
}

client switch-access-02 {
    ipaddr = 10.10.100.11
    secret = R4d1u5_S3cr3t_K3y!
    shortname = access-switch-02
    nastype = cisco
}
EOF

# Configure LDAP module for Active Directory integration
sudo tee /etc/freeradius/3.0/mods-available/ldap << 'EOF'
ldap {
    server = 'ldap://dc01.corp.example.com'
    identity = 'CN=radius-svc,OU=Service Accounts,DC=corp,DC=example,DC=com'
    password = 'ServiceAccountPassword123!'
    base_dn = 'DC=corp,DC=example,DC=com'

    user {
        base_dn = "${..base_dn}"
        filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})"
    }

    group {
        base_dn = "${..base_dn}"
        filter = "(objectClass=group)"
        membership_attribute = 'memberOf'
    }
}
EOF

sudo ln -s /etc/freeradius/3.0/mods-available/ldap /etc/freeradius/3.0/mods-enabled/ldap

步骤 2：配置 VLAN 分配策略

# Configure authorization policies for dynamic VLAN assignment
sudo tee /etc/freeradius/3.0/policy.d/vlan-assignment << 'EOF'
# VLAN assignment based on group membership
vlan_assignment {
    if (&LDAP-Group[*] == "CN=IT-Staff,OU=Groups,DC=corp,DC=example,DC=com") {
        update reply {
            Tunnel-Type = VLAN
            Tunnel-Medium-Type = IEEE-802
            Tunnel-Private-Group-ID = "10"
        }
    }
    elsif (&LDAP-Group[*] == "CN=Developers,OU=Groups,DC=corp,DC=example,DC=com") {
        update reply {
            Tunnel-Type = VLAN
            Tunnel-Medium-Type = IEEE-802
            Tunnel-Private-Group-ID = "15"
        }
    }
    elsif (&LDAP-Group[*] == "CN=Finance,OU=Groups,DC=corp,DC=example,DC=com") {
        update reply {
            Tunnel-Type = VLAN
            Tunnel-Medium-Type = IEEE-802
            Tunnel-Private-Group-ID = "20"
        }
    }
    else {
        # Default: Guest VLAN for unknown users
        update reply {
            Tunnel-Type = VLAN
            Tunnel-Medium-Type = IEEE-802
            Tunnel-Private-Group-ID = "40"
        }
    }
}
EOF

# Add vlan_assignment to the authorize section
# Edit /etc/freeradius/3.0/sites-enabled/default
# In the authorize section, add: vlan_assignment

# Configure EAP for 802.1X authentication
sudo tee /etc/freeradius/3.0/mods-available/eap << 'EAPEOF'
eap {
    default_eap_type = peap
    timer_expire = 60
    max_sessions = 4096

    tls-config tls-common {
        private_key_file = /etc/freeradius/3.0/certs/server.key
        certificate_file = /etc/freeradius/3.0/certs/server.pem
        ca_file = /etc/freeradius/3.0/certs/ca.pem
        dh_file = /etc/freeradius/3.0/certs/dh
        cipher_list = "HIGH:!aNULL:!MD5"
        tls_min_version = "1.2"
    }

    peap {
        tls = tls-common
        default_eap_type = mschapv2
        virtual_server = inner-tunnel
    }

    tls {
        tls = tls-common
    }
}
EAPEOF

# Start FreeRADIUS in debug mode for testing
sudo freeradius -X

# Test authentication
radtest testuser TestPassword123 localhost 0 testing123

步骤 3：在 Cisco 交换机上配置 802.1X

! Enable AAA on the switch
enable
configure terminal

aaa new-model
aaa authentication dot1x default group radius
aaa authorization network default group radius
aaa accounting dot1x default start-stop group radius

! Configure RADIUS server
radius server FREERADIUS
  address ipv4 10.10.100.200 auth-port 1812 acct-port 1813
  key R4d1u5_S3cr3t_K3y!
  exit

! Enable 802.1X globally
dot1x system-auth-control

! Configure access ports for 802.1X
interface range GigabitEthernet1/0/1-24
  switchport mode access
  switchport access vlan 999
  authentication port-control auto
  authentication order dot1x mab
  authentication priority dot1x mab
  dot1x pae authenticator
  dot1x timeout tx-period 10
  mab
  authentication event fail action authorize vlan 999
  authentication event no-response action authorize vlan 40
  authentication host-mode multi-auth
  spanning-tree portfast
  exit

! Configure MAB (MAC Authentication Bypass) for devices without 802.1X
! Devices like printers, IP phones that cannot run a supplicant
interface range GigabitEthernet1/0/25-36
  switchport mode access
  switchport access vlan 999
  authentication port-control auto
  authentication order mab
  mab
  authentication event fail action authorize vlan 999
  authentication host-mode single-host
  spanning-tree portfast
  exit

! Configure guest VLAN for unauthenticated devices
interface range GigabitEthernet1/0/1-24
  authentication event no-response action authorize vlan 40
  authentication event fail action authorize vlan 999
  exit

! Configure critical VLAN for RADIUS server unavailability
interface range GigabitEthernet1/0/1-36
  authentication event server dead action authorize vlan 10
  authentication event server alive action reinitialize
  exit

步骤 4：部署 PacketFence NAC 进行合规性评估

# Install PacketFence
curl -fsSL https://inverse.ca/downloads/GPG_PUBLIC_KEY | sudo gpg --dearmor -o /etc/apt/keyrings/inverse.gpg
echo "deb [signed-by=/etc/apt/keyrings/inverse.gpg] https://inverse.ca/downloads/PacketFence/debian bookworm bookworm" | \
  sudo tee /etc/apt/sources.list.d/packetfence.list
sudo apt update && sudo apt install -y packetfence

# Run the PacketFence configurator
sudo /usr/local/pf/bin/pfcmd configreload

# Access web admin: https://<packetfence-ip>:1443

# Configure PacketFence connection profiles
# Admin UI: Configuration > Policies and Access Control > Connection Profiles

# Create compliance check (Windows Update status)
# Admin UI: Configuration > Compliance > Scan Engines
# Add: Windows Update compliance check
# Remediation VLAN: 999 (quarantine)

# Configure RADIUS integration
# PacketFence acts as a RADIUS proxy, receiving requests from switches
# and enforcing posture-based VLAN assignment

# Edit /usr/local/pf/conf/switches.conf
sudo tee -a /usr/local/pf/conf/switches.conf << 'EOF'
[10.10.100.10]
description=Access Switch 01
type=Cisco::Catalyst_2960
mode=production
radiusSecret=R4d1u5_S3cr3t_K3y!
SNMPVersion=2c
SNMPCommunityRead=public
SNMPCommunityWrite=private
VlanMap=Y
registrationVlan=40
isolationVlan=999
normalVlan=10
EOF

步骤 5：在端点上报配置客户端

# Windows Group Policy for 802.1X configuration
# Computer Configuration > Policies > Windows Settings > Security Settings
# > System Services > Wired AutoConfig: Automatic
# > Network Policies:
#   Authentication method: Microsoft: Protected EAP (PEAP)
#   Inner method: EAP-MSCHAPv2
#   Trusted Root CA: Corporate CA

# Linux 802.1X configuration with wpa_supplicant
sudo tee /etc/wpa_supplicant/wpa_supplicant-wired.conf << 'EOF'
ctrl_interface=/var/run/wpa_supplicant
ap_scan=0

network={
    key_mgmt=IEEE8021X
    eap=PEAP
    identity="[email protected]"
    password="UserPassword123"
    ca_cert="/etc/ssl/certs/corporate-ca.pem"
    phase2="auth=MSCHAPV2"
}
EOF

# Start wpa_supplicant for wired 802.1X
sudo wpa_supplicant -i eth0 -D wired -c /etc/wpa_supplicant/wpa_supplicant-wired.conf -B

# Verify authentication status
wpa_cli -i eth0 status

# macOS: System Preferences > Network > Ethernet > 802.1X
# Configure with PEAP and corporate credentials

步骤 6：测试并验证 NAC 部署

# Test 1: Authenticated device gets correct VLAN
# Connect a corporate laptop with 802.1X configured
# Verify VLAN assignment on the switch:
# show authentication sessions interface Gi1/0/1

# Expected:
# Session ID: 0A0A0A01000000010001
# Status: Authorized
# Domain: DATA
# Oper host mode: multi-auth
# Oper control dir: both
# Authorized By: Authentication Server
# Vlan Policy: 10

# Test 2: Unauthenticated device goes to guest VLAN
# Connect a device without 802.1X supplicant
# show authentication sessions interface Gi1/0/2
# Expected: Vlan Policy: 40 (Guest)

# Test 3: Failed authentication goes to quarantine
# Attempt authentication with wrong credentials
# Expected: Vlan Policy: 999 (Quarantine)

# Test 4: RADIUS server failure - critical VLAN
# Stop FreeRADIUS temporarily
# Connect a new device
# Expected: Vlan Policy: 10 (Critical/failover)

# Test 5: MAC Authentication Bypass
# Connect a printer (no supplicant)
# MAB should authenticate based on MAC address in RADIUS
# show authentication sessions interface Gi1/0/25

# Generate authentication report
# show authentication sessions | include Auth
# show dot1x all summary

关键概念

术语	定义
802.1X	IEEE 基于端口的网络访问控制标准，在授予网络访问权限前通过 EAP 和 RADIUS 对设备进行身份验证
RADIUS	远程身份验证拨入用户服务协议，网络设备用它来验证用户身份并接收授权属性（VLAN、ACL）
MAB（MAC 身份验证绕过）	回退身份验证方法，将设备的 MAC 地址用作无法运行 802.1X 客户端的设备的凭据
EAP-PEAP	受保护的可扩展身份验证协议，将 EAP 封装在 TLS 隧道中，常与 MSCHAPv2 配合用于用户名/密码身份验证
合规性评估	在授予完整网络访问权限前，评估端点的合规状态（操作系统补丁、杀毒软件、加密）
动态 VLAN 分配	由 RADIUS 根据用户身份、组成员资格或设备类型自动分配 VLAN，从而无需基于端口的静态 VLAN 配置

工具与系统

• FreeRADIUS：开源 RADIUS 服务，支持 EAP-TLS、PEAP、LDAP 集成和动态 VLAN 分配
• PacketFence：开源 NAC 解决方案，提供 802.1X 集成、合规性评估、强制门户和设备注册
• Cisco ISE：企业级 NAC 平台，具备设备画像、合规性、访客管理和 TrustSec 集成
• wpa_supplicant：面向 Linux 和嵌入式系统的开源 802.1X 客户端，支持 EAP-TLS、PEAP 和 TTLS
• Microsoft NPS：Windows Server 的 RADIUS 实现，可与 Active Directory 原生集成以进行 802.1X 身份验证

常见场景

场景：在医院网络中部署 802.1X NAC

背景：一家医院需要实施网络访问控制以满足 HIPAA 要求。网络包括临床工作站（已加入域）、医疗设备（不支持 802.1X）、医生 BYOD 设备和访客 WiFi。如果 RADIUS 服务不可用，部署不得中断患者护理。

方法：

1. 部署 FreeRADIUS 并与 Active Directory 集成，用于用户身份验证和基于组的 VLAN 分配
2. 通过组策略为已加入域的工作站配置 EAP-PEAP，并启用自动注册
3. 将医疗设备（输液泵、监护仪）注册到 RADIUS 数据库中，使用其 MAC 地址进行 MAB 身份验证
4. 将交换机配置为身份验证顺序 dot1x 然后 mab，并在 RADIUS 不可达时回退到关键 VLAN（临床 VLAN）
5. 部署 PacketFence 强制门户，用于医生 BYOD 入网注册，并分配受限访问 VLAN
6. 配置态势检查，要求 Windows Update 合规和 BitLocker 加密才能获得完全访问权限
7. 通过停止 RADIUS 并验证设备仍停留在关键 VLAN 且不失去访问权限，测试故障转移场景

陷阱：

• 未配置关键 VLAN 回退，导致 RADIUS 不可用时设备失去网络访问
• 随着医疗设备被更换或移动，MAB MAC 地址数据库变得过时
• 802.1X 超时导致工作站登录延迟，尤其是在 RADIUS 响应缓慢时
• 未在 IP 电话和工作站菊花链连接的端口上测试多主机模式

输出格式

## NAC Deployment Report

**RADIUS Server**: freeradius-01 (10.10.100.200)
**NAC Platform**: PacketFence 13.1
**Switches Configured**: 12 access switches
**Total Ports**: 576 access ports

### Authentication Summary (24-hour)

| Auth Type | Success | Failure | Total |
|-----------|---------|---------|-------|
| 802.1X (PEAP) | 342 | 12 | 354 |
| MAB | 87 | 3 | 90 |
| Guest Portal | 23 | 5 | 28 |

### VLAN Assignment Distribution

| VLAN | Name | Assigned Devices |
|------|------|------------------|
| 10 | Corporate | 245 |
| 15 | Development | 67 |
| 20 | Finance | 30 |
| 40 | Guest | 23 |
| 50 | Medical Devices | 87 |
| 999 | Quarantine | 15 (posture fail) |

### Compliance Status
- 802.1X coverage: 100% of access ports
- Posture pass rate: 95.8% (15 devices quarantined for missing patches)
- RADIUS failover tested: Successful (critical VLAN activated in 3 seconds)