Authentication for educational site, before being controlled by PAN

Reply
Highlighted
L3 Networker

Authentication for educational site, before being controlled by PAN

What I'm after is a system that acts as a RADIUS server to authenticate  both wired and wireless users over the network via EAP. The network will  then authenticate the user and allow them access to specific VLANs,  depending on the user and what machine they are logged on to.

Some possible scenarios:
Staff Member without admin rights:
-  If they logon to a School-managed Library fixed PC, they should get  access to the Staff-Managed VLAN.
- If they logon to an unmanaged  personal laptop that they've brought in from home, they should get  access to the Staff-Unmanaged VLAN.

Student without admin rights:
- If they logon to a School -managed Library fixed PC, they should get access to the  Student-Managed VLAN.
- If they logon to their assigned School-managed student laptop, they should get access to the  Student-Managed VLAN.
- If they logon to another School-managed student laptop, they should  be disallowed access.

Student with admin rights on their  Kristin-managed student laptop only:
- If they logon to a School-managed Library fixed PC, they should get access to the  Student-Managed VLAN.
- If they logon to their assigned School-managed student laptop (with  admin rights), they should get access to the Student-SemiManaged VLAN.
-  If they logon to another School-managed student laptop, they should be  disallowed access.
- If they logon to an unmanaged personal laptop that they've brought in  from home, they should get access to the Student-Unmanaged VLAN.

Guest  who has registered with School:
- If they logon to a School-managed Library fixed PC, they should get access to the Guest  VLAN.
- If they logon to an unmanaged personal laptop that they've brought in,  they should get access to the Guest VLAN.

Intruder who hasn't  registered with School:
- If they logon to any personal laptop, and  try to plug in to our network, they should be disallowed access.

Up to 1/2 of the student owned systems will be Apple Macs, just to make things interesting.


The RADIUS server will use something like PEAP/EAP-MSCHAPv2. On School-managed machines joined to the School AD domain, the  authentication will happen automatically and the user won't have to  enter any usernames/passwords. For an unmanaged machine, the user will  be prompted to enter their AD username and password (or a guest username  and password).

So we would need to have info on the user (mainly coming from AD)  and the device they are connecting from. We'd need to either be able to  point the RADIUS server at an existing database, or be able to  automatically sync the RADIUS server database with our asset database or  CMDB.

We also need to be able to get the log information of which user was  logged on to which MAC address (real time), so that we can convert this  to an IP address via DHCP logs,  and then send the IP-to-user info to Palo Alto. We don't want a user on  their unmanaged  home machine entering a password once for the RADIUS server, then again  for Palo Alto's captive  portal.

I suppose we are most similar to a tertiary network in the US where  students bring in their  own devices and enter a
username and password to be allowed on to the network, before something  like Palo Alto takes over and does firewalling of appropriate content.

Anyone know of a solution that is capable of this?

L6 Presenter

Re: Authentication for educational site, before being controlled by PAN

Thank you for providing your requirements in details.

If those groups of devices (School-managed Library fixed PCs, unmanaged  personal laptops, School-managed student laptops, etc) are separated by IP subnets or VLANs, then it is very likely that Palo Alto Networks can help meet your needs. If not, some network changes may be required.  However, it is best that you contact your Palo Alto sales team for the design to ensure success.

Some of your requests can be administered at the machine PCs/Macs levels.  For examples:

Student without admin rights:

if they logon to another School-managed student laptop, they should  be disallowed access.

A: you can restrict the account login of each assigned student machine to the specific student & nwk admins only.

Student with admin rights on their  Kristin-managed student laptop only:

If they logon to another School-managed student laptop, they should be  disallowed access.

A: Same as above, you can restrict the account login of each assigned student machine to the specific student & nwk admins only.

Cheers,

L3 Networker

Re: Authentication for educational site, before being controlled by PAN

Hi,

So thats actually the problem. Due to the dynamic nature of the environment, its getting the device to authenticate to the correct VLAN that is causing us a headache.

Once the VLAN is assigned its plain sailing.

SteveR

L0 Member

Re: Authentication for educational site, before being controlled by PAN

Hi Steve,

I'm not sure if you've found a solution yet, but what you are describing sounds like Network Access Control.  I don't know if Palo Alto recommends any particular NAC vendor, but there are several out there.  Usually these solutions will do exactly what you are looking for: Identify user/machine based on your choice of credentials then place them in the correct VLAN (the NAC product does this by communicating directly with the LAN switch).

A couple I'd recommend checking out:

Bradford Networks (www.bradfordnetworks.com)

Forescout (www.forescout.com)

good luck!

Andrew

L4 Transporter

Re: Authentication for educational site, before being controlled by PAN

I agree - looks like a NAC product is required.

You can then tie the NAC into Palo Alto's User-ID.  So long as the Radius server used for EAP/PEAP has the user and IP credentials, it can then feed this information into the XML API of the User-ID Agent.  So you end up with NAC and also IAC :smileywink:

Thanks

James

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!