Implements 802.1X port-based NAC using RADIUS (FreeRADIUS), PacketFence, and switch configs for identity-based access policies, posture assessment, and dynamic VLAN assignment.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
- 强制执行基于身份的网络访问,仅允许经过认证和合规的设备连接网络
Implements 802.1X port-based NAC using RADIUS authentication, PacketFence, and switch configs for identity-based policies, posture assessment, and VLAN assignment.
Implements 802.1X NAC using RADIUS (FreeRADIUS), PacketFence posture assessment, and switch configs for identity-based access, VLAN assignment, and device quarantine.
Deploys Cisco ISE for 802.1X wired/wireless authentication, MAB, posture assessment, and dynamic VLAN assignment in enterprise network access control.
Share bugs, ideas, or general feedback.
不适用于没有互补控制的独立安全解决方案、网络设备不支持 802.1X 认证客户端的网络,或关键基础设施没有适当故障转移机制的情况。
# 安装 FreeRADIUS
sudo apt install -y freeradius freeradius-utils freeradius-ldap
# 配置 RADIUS 客户端(向 RADIUS 进行认证的交换机)
sudo tee /etc/freeradius/3.0/clients.conf << 'EOF'
client switch-core-01 {
ipaddr = 10.10.100.1
secret = R4d1u5_S3cr3t_K3y!
shortname = core-switch
nastype = cisco
}
client switch-access-01 {
ipaddr = 10.10.100.10
secret = R4d1u5_S3cr3t_K3y!
shortname = access-switch-01
nastype = cisco
}
client switch-access-02 {
ipaddr = 10.10.100.11
secret = R4d1u5_S3cr3t_K3y!
shortname = access-switch-02
nastype = cisco
}
EOF
# 配置 LDAP 模块用于 Active Directory 集成
sudo tee /etc/freeradius/3.0/mods-available/ldap << 'EOF'
ldap {
server = 'ldap://dc01.corp.example.com'
identity = 'CN=radius-svc,OU=Service Accounts,DC=corp,DC=example,DC=com'
password = 'ServiceAccountPassword123!'
base_dn = 'DC=corp,DC=example,DC=com'
user {
base_dn = "${..base_dn}"
filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})"
}
group {
base_dn = "${..base_dn}"
filter = "(objectClass=group)"
membership_attribute = 'memberOf'
}
}
EOF
sudo ln -s /etc/freeradius/3.0/mods-available/ldap /etc/freeradius/3.0/mods-enabled/ldap
# 配置基于动态 VLAN 分配的授权策略
sudo tee /etc/freeradius/3.0/policy.d/vlan-assignment << 'EOF'
# 基于组成员身份的 VLAN 分配
vlan_assignment {
if (&LDAP-Group[*] == "CN=IT-Staff,OU=Groups,DC=corp,DC=example,DC=com") {
update reply {
Tunnel-Type = VLAN
Tunnel-Medium-Type = IEEE-802
Tunnel-Private-Group-ID = "10"
}
}
elsif (&LDAP-Group[*] == "CN=Developers,OU=Groups,DC=corp,DC=example,DC=com") {
update reply {
Tunnel-Type = VLAN
Tunnel-Medium-Type = IEEE-802
Tunnel-Private-Group-ID = "15"
}
}
elsif (&LDAP-Group[*] == "CN=Finance,OU=Groups,DC=corp,DC=example,DC=com") {
update reply {
Tunnel-Type = VLAN
Tunnel-Medium-Type = IEEE-802
Tunnel-Private-Group-ID = "20"
}
}
else {
# 默认:未知用户使用访客 VLAN
update reply {
Tunnel-Type = VLAN
Tunnel-Medium-Type = IEEE-802
Tunnel-Private-Group-ID = "40"
}
}
}
EOF
# 将 vlan_assignment 添加到 authorize 段
# 编辑 /etc/freeradius/3.0/sites-enabled/default
# 在 authorize 段添加:vlan_assignment
# 配置 EAP 用于 802.1X 认证
sudo tee /etc/freeradius/3.0/mods-available/eap << 'EAPEOF'
eap {
default_eap_type = peap
timer_expire = 60
max_sessions = 4096
tls-config tls-common {
private_key_file = /etc/freeradius/3.0/certs/server.key
certificate_file = /etc/freeradius/3.0/certs/server.pem
ca_file = /etc/freeradius/3.0/certs/ca.pem
dh_file = /etc/freeradius/3.0/certs/dh
cipher_list = "HIGH:!aNULL:!MD5"
tls_min_version = "1.2"
}
peap {
tls = tls-common
default_eap_type = mschapv2
virtual_server = inner-tunnel
}
tls {
tls = tls-common
}
}
EAPEOF
# 以调试模式启动 FreeRADIUS 进行测试
sudo freeradius -X
# 测试认证
radtest testuser TestPassword123 localhost 0 testing123
! 在交换机上启用 AAA
enable
configure terminal
aaa new-model
aaa authentication dot1x default group radius
aaa authorization network default group radius
aaa accounting dot1x default start-stop group radius
! 配置 RADIUS 服务器
radius server FREERADIUS
address ipv4 10.10.100.200 auth-port 1812 acct-port 1813
key R4d1u5_S3cr3t_K3y!
exit
! 全局启用 802.1X
dot1x system-auth-control
! 为接入端口配置 802.1X
interface range GigabitEthernet1/0/1-24
switchport mode access
switchport access vlan 999
authentication port-control auto
authentication order dot1x mab
authentication priority dot1x mab
dot1x pae authenticator
dot1x timeout tx-period 10
mab
authentication event fail action authorize vlan 999
authentication event no-response action authorize vlan 40
authentication host-mode multi-auth
spanning-tree portfast
exit
! 为不支持 802.1X 的设备配置 MAB(MAC 认证旁路)
! 如打印机、IP 电话等无法运行认证客户端的设备
interface range GigabitEthernet1/0/25-36
switchport mode access
switchport access vlan 999
authentication port-control auto
authentication order mab
mab
authentication event fail action authorize vlan 999
authentication host-mode single-host
spanning-tree portfast
exit
! 为未认证设备配置访客 VLAN
interface range GigabitEthernet1/0/1-24
authentication event no-response action authorize vlan 40
authentication event fail action authorize vlan 999
exit
! 为 RADIUS 服务器不可用时配置关键 VLAN
interface range GigabitEthernet1/0/1-36
authentication event server dead action authorize vlan 10
authentication event server alive action reinitialize
exit
# 安装 PacketFence
curl -fsSL https://inverse.ca/downloads/GPG_PUBLIC_KEY | sudo gpg --dearmor -o /etc/apt/keyrings/inverse.gpg
echo "deb [signed-by=/etc/apt/keyrings/inverse.gpg] https://inverse.ca/downloads/PacketFence/debian bookworm bookworm" | \
sudo tee /etc/apt/sources.list.d/packetfence.list
sudo apt update && sudo apt install -y packetfence
# 运行 PacketFence 配置向导
sudo /usr/local/pf/bin/pfcmd configreload
# 访问 Web 管理界面:https://<packetfence-ip>:1443
# 配置 PacketFence 连接配置文件
# 管理 UI:Configuration > Policies and Access Control > Connection Profiles
# 创建合规检查(Windows 更新状态)
# 管理 UI:Configuration > Compliance > Scan Engines
# 添加:Windows Update 合规检查
# 修复 VLAN:999(隔离区)
# 配置 RADIUS 集成
# PacketFence 作为 RADIUS 代理,接收来自交换机的请求
# 并强制执行基于态势的 VLAN 分配
# 编辑 /usr/local/pf/conf/switches.conf
sudo tee -a /usr/local/pf/conf/switches.conf << 'EOF'
[10.10.100.10]
description=Access Switch 01
type=Cisco::Catalyst_2960
mode=production
radiusSecret=R4d1u5_S3cr3t_K3y!
SNMPVersion=2c
SNMPCommunityRead=public
SNMPCommunityWrite=private
VlanMap=Y
registrationVlan=40
isolationVlan=999
normalVlan=10
EOF
# Windows 组策略用于 802.1X 配置
# 计算机配置 > 策略 > Windows 设置 > 安全设置
# > 系统服务 > 有线自动配置:自动
# > 网络策略:
# 认证方式:Microsoft:受保护的 EAP (PEAP)
# 内部方法:EAP-MSCHAPv2
# 受信任的根 CA:企业 CA
# Linux 802.1X 配置使用 wpa_supplicant
sudo tee /etc/wpa_supplicant/wpa_supplicant-wired.conf << 'EOF'
ctrl_interface=/var/run/wpa_supplicant
ap_scan=0
network={
key_mgmt=IEEE8021X
eap=PEAP
identity="testuser@corp.example.com"
password="UserPassword123"
ca_cert="/etc/ssl/certs/corporate-ca.pem"
phase2="auth=MSCHAPV2"
}
EOF
# 启动 wpa_supplicant 进行有线 802.1X
sudo wpa_supplicant -i eth0 -D wired -c /etc/wpa_supplicant/wpa_supplicant-wired.conf -B
# 验证认证状态
wpa_cli -i eth0 status
# macOS:系统偏好设置 > 网络 > 以太网 > 802.1X
# 配置 PEAP 和企业凭据
# 测试 1:已认证设备获得正确的 VLAN
# 连接配置了 802.1X 的企业笔记本电脑
# 在交换机上验证 VLAN 分配:
# show authentication sessions interface Gi1/0/1
# 预期结果:
# Session ID: 0A0A0A01000000010001
# Status: Authorized
# Domain: DATA
# Oper host mode: multi-auth
# Oper control dir: both
# Authorized By: Authentication Server
# Vlan Policy: 10
# 测试 2:未认证设备进入访客 VLAN
# 连接没有 802.1X 认证客户端的设备
# show authentication sessions interface Gi1/0/2
# 预期结果:Vlan Policy: 40(访客)
# 测试 3:认证失败进入隔离区
# 使用错误凭据尝试认证
# 预期结果:Vlan Policy: 999(隔离区)
# 测试 4:RADIUS 服务器故障 - 关键 VLAN
# 临时停止 FreeRADIUS
# 连接新设备
# 预期结果:Vlan Policy: 10(关键/故障转移)
# 测试 5:MAC 认证旁路
# 连接打印机(无认证客户端)
# MAB 应基于 RADIUS 中的 MAC 地址进行认证
# show authentication sessions interface Gi1/0/25
# 生成认证报告
# show authentication sessions | include Auth
# show dot1x all summary
| 术语 | 定义 |
|---|---|
| 802.1X | IEEE 基于端口的网络访问控制标准,通过 EAP 和 RADIUS 在授予网络访问权限前对设备进行认证 |
| RADIUS | 远程认证拨入用户服务协议,网络设备用其对用户进行认证并接收授权属性(VLAN、ACL) |
| MAB(MAC 认证旁路) | 使用设备 MAC 地址作为凭据的回退认证方法,适用于无法运行 802.1X 认证客户端的设备 |
| EAP-PEAP | 受保护的可扩展认证协议,将 EAP 封装在 TLS 隧道中,通常与 MSCHAPv2 一起用于用户名/密码认证 |
| 态势评估(Posture Assessment) | 在授予完整网络访问权限前对端点合规状态(OS 补丁、防病毒、加密)的评估 |
| 动态 VLAN 分配(Dynamic VLAN Assignment) | RADIUS 驱动的自动 VLAN 放置,基于用户身份、组成员身份或设备类型,无需静态端口 VLAN 配置 |
场景背景:一家医院需要强制执行网络访问控制以满足 HIPAA 要求。网络包括临床工作站(已加入域)、医疗设备(不支持 802.1X)、医生 BYOD 设备和访客 WiFi。如果 RADIUS 服务器不可用,部署不得中断患者护理。
方法:
常见陷阱:
## NAC 部署报告
**RADIUS 服务器**:freeradius-01 (10.10.100.200)
**NAC 平台**:PacketFence 13.1
**已配置交换机**:12 台接入交换机
**端口总数**:576 个接入端口
### 认证摘要(24 小时)
| 认证类型 | 成功 | 失败 | 总计 |
|---------|------|------|------|
| 802.1X (PEAP) | 342 | 12 | 354 |
| MAB | 87 | 3 | 90 |
| 访客门户 | 23 | 5 | 28 |
### VLAN 分配分布
| VLAN | 名称 | 已分配设备数 |
|------|------|-------------|
| 10 | Corporate(企业) | 245 |
| 15 | Development(开发) | 67 |
| 20 | Finance(财务) | 30 |
| 40 | Guest(访客) | 23 |
| 50 | Medical Devices(医疗设备) | 87 |
| 999 | Quarantine(隔离区) | 15(态势检查失败) |
### 合规状态
- 802.1X 覆盖率:100% 的接入端口
- 态势通过率:95.8%(15 台设备因缺少补丁被隔离)
- RADIUS 故障转移测试:成功(3 秒内激活关键 VLAN)