I'm using RADIUS for port security in my environment on publicly accessible ports (meeting rooms, etc.) We have HP Procurve switches and Aruba Clearpass is handling the authentication requests (with Active Directory DCs on the back end).
It's set up to default to a guest VLAN (which has no routing into our production VLAN, only out to the internet) and then switch to the production VLAN with a successful AD authentication.
In the meeting rooms we have fixed laptops and I'm having a problem currently that when the laptops have been logged out for longer than the "unauth" period (60 seconds currently), they get kicked back onto the guest VLAN. Then users whose credentials aren't currently cached on these laptops aren't able to hit the DC to log in on the laptop.
I'm not sure how to solve this exactly. I'm reticent to give one of the DCs an interface in the guest VLAN because I'm not sure about the security implications. What else could I do?
0 Answers