802.1X supplicant on access switches for uplink authentication (for security & automation)

[Volker_Kull]

APs are mostly authenticated at a switchport to use an automatic configuration of switchport behaviours (VLANs, port authentication, ..) like I mentioned in my “AP-Aware” idea. We need this function as well for authentication and automation to connect access switches to core/distribution/fabric switches. This ist for security reasons  in case of using distributed switches in office, production, IOT/OT, … to prevent unauthorized usage uf the uplink ports as well as a basic function to use automation in a distributed environment.

This is not new to use a 802.1X supplicant on access devices (like APs) to connect to switchports and use automation for on-/offboarding. 

More and more small devices in production, healthcare, education environments for headless devices, IOT/OT force us to deliver an easy to deploy and use environment.

br

Volker

[AlexN]

That means there are substantial benefits to introduce them to Fabric, right ?

In legacy networking scenarios achieving same automation levels can be more challenging however not impossible:  for instance combination of ZTP+ and OSPF/BGP authentication would do similar trick with EXOS.

So is your request limited to only EXOS then ?  

BR,

Alex

[Volker_Kull]

Hello AlexN!

Fabric is not everywhere and cloud as well.

In our customer base 99% of access switches are EXOS, and more than 50% of the distribution/core switches are EXOS as well.

Volker

[AlexN]

In fabric environment is’t already the case. With auto-sense feature added in 8.3 for Zero Touch Fabric, it will cater for similar scenario.

Mechanism there will not be 802.1x specific, however from security perspective you can use:

1. ISIS HMAC
2. Fabric Attach authentication
3. MACSEC keys