GS108T port authentication with 802.1x problem

[polecats]

Recently I bought a couple of GS108T switches that I'm supposed to use together with 802.1x authentication.

I set up a PKI structure that worked good and used NPS (network policy server) on Win 2k8 to manage the 802.1x.

It didn't work, and after a while when I tried tried and tried again I decided to call the Netgear support here i Sweden. I asked them how long the PKI-keyes for the certificates can be (2048 or 4096-bit or something like that). They started a case and now I got an answer:

"Notes added by 30002
GS108T and all smart switches only allow port authetication using MD5
Certificate based port authetication is not supported.

To have suppport you need managed switch"

Now two questions:

1) Isn't GS108T a managed switch?

2) I now certificates aren't supporter, which are the options that I can use instead for 802.1x? Please give me some examples/ideas 🙂

Thanks!

/Calle

[polecats · Accepted solution]

NogNeetMachinaal wrote:
Hello, What settings did you use on all three for making this work? For now, I would settle for EAP-MD5. Grtz - Will

You have to unlock EAP-MD5 in 2008 Server and then choose it in Network Policy Server as authentication option.

http://social.technet.microsoft.com/Forums/en-US/winserverNAP/thread/e801bdac-9347-4efb-9d7c-bcf4d64...

I think they have removed it in Server 2008 R2 though.

[beisser]

polecats wrote:

Recently I bought a couple of GS108T switches that I'm supposed to use together with 802.1x authentication. I set up a PKI structure that worked good and used NPS (network policy server) on Win 2k8 to manage the 802.1x. It didn't work, and after a while when I tried tried and tried again I decided to call the Netgear support here i Sweden. I asked them how long the PKI-keyes for the certificates can be (2048 or 4096-bit or something like that). They started a case and now I got an answer: "Notes added by 30002 GS108T and all smart switches only allow port authetication using MD5 Certificate based port authetication is not supported. To have suppport you need managed switch" Now two questions: 1) Isn't GS108T a managed switch? 2) I now certificates aren't supporter, which are the options that I can use instead for 802.1x? Please give me some examples/ideas :) Thanks! /Calle

you can use md5 instead of certificates (md5 is way less secure of course). the only switches that support eap (what you want to use) are the big 7000 series switches.

[fordem]

No - the GS108T is not a managed switch, it's what's called a SmartSwitch, in that it has limited management capabilties, rather than being fully managed. It is also significantly cheaper.

I've only used 802.1x authentication in a wireless environment so I can't assist with the second question.

[polecats]

Thanks for the replies.

It's only the FSMxxxx switches that support EAP certificates? (where the "M" in FSM stands for managed)

There are NO information about this in the specification pages or any of the manuals for both the GS108T and the FS728TS switches. How am I able to figure this out before purchasing? The specs says "IEEE 802.1x".

Now I have 7 GS108T and 2 FS728TS, that I'm not sure that I can use together with Server 2008 Network Policy Server... Can I?

Big problem right now...

[polecats]

beisser wrote:
you can use md5 instead of certificates (md5 is way less secure of course). the only switches that support eap (what you want to use) are the big 7000 series switches.

Isn't MD5 Challenge an EAP part?
Which MD5 auth am I supposed to use?

Thanks.

[polecats]

OK, I'm back.

Now I've got the EAP-MD5 auth to work Win2k8Srv - GS108T - XP client. The problem is that you can't save the password. This means that when you've restared the client you cannot log on as domain user, the port hasn't been authorized. This seems like a big limitation... gaaah. Does anyone have a solution?

I can't understand why cert isn't an option for the switch.

[NogNeetMachinaa]

polecats wrote:
OK, I'm back. Now I've got the EAP-MD5 auth to work Win2k8Srv - GS108T - XP client.

Hello, What settings did you use on all three for making this work? For now, I would settle for EAP-MD5. Grtz - Will

[polecats · Accepted solution]

NogNeetMachinaal wrote:
Hello, What settings did you use on all three for making this work? For now, I would settle for EAP-MD5. Grtz - Will

You have to unlock EAP-MD5 in 2008 Server and then choose it in Network Policy Server as authentication option.

http://social.technet.microsoft.com/Forums/en-US/winserverNAP/thread/e801bdac-9347-4efb-9d7c-bcf4d64...

I think they have removed it in Server 2008 R2 though.