交换机+windows ias+windows ad服务实现802.1x身份验证,可以按照用户名来控制vlan的分配，即无帐号就无法分配到vlan，也就无法分配到ip地址，不论PC如何接入网络，只要无合法的帐号就不能登陆网络。
802。1x的实现有两种验证方式，一种是MD5的方式，即质询应答的方式，这种方式登陆系统后，需要用户再次输入验证帐号和密码，一种是peap的验证方法，由microsoft支持此验证方法，可以实现一次登陆即验证成功，因此对于user是透明的。
cisco有关于这方面的配置文档，大家可以去查下，cisco的配置只是把交换机配置成一个radius客户端，而策略的定义是在windows ias上实现的（windows官方也有些文档）
目前国内大企业使用的只有台机电，我们公司我也成功的实现了，效果非常的好，大大提高了整个网络的安全性。
写的比较简单，望大家见谅，只是提供些新技术的思路和信息，如有疑问，可以给再问我，谢谢。
.
Step 1: If you do not already have an Active Directory environment setup, you will need to install a Windows 2000 server and configure Active Directory on at least one server. Make sure your DNS servers are setup correctly to function correctly with Active Directory.
Step 2: Install the Microsoft IAS service onto the Domain Controller running Active Directory. IAS can be found on your Windows 2000 Server CD.
• From Control Panel go to Add/Remove Windows Components.
• Select the Networking Services option and click on the “Details” button to add a new network service.
• Select the Internet Authentication Service component to install.
Step 3: Define the IAS RADIUS clients that will authenticate to this IAS server. This will include all the Foundry devices that will be supporting 802.1X client authentication. Create a new IAS client entry for each Foundry device. Foundry devices can also have multiple IAS RADIUS servers defined to eliminate single points of failure.
• From the IAS management screen, right-click on Clients and select New Client.
• Enter the name of the device to give it a “Friendly Name” and select RADIUS as the protocol.
• Enter the IP Address or DNS Name of the Foundry device, select RADIUS Standard as the Client Vendor, check the “Client must always send the signature attribute in the request” option, and enter the shared secret that will be used to identify the Foundry device. This secret must be the same string used on the Foundry device to define the RADIUS server.
Step 4: Create a Remote Access Policy to govern access.
• From the IAS management screen, right-click on Remote Access Policies and select New Remote Access Policy.
• Enter a Policy Friendly Name to describe the policy.
• Select the Attribute Type to regulate access with. The one that makes the most sense for Foundry 802.1X Port Authentication is Day-and-Time-Restriction.
• Set the days and times that users are allowed to authenticate. This example allowed all days and times.
Step 5: Turn on Remote Access Logging.
• From the IAS management screen, select the Remote Access Logging option. On the right pane, right-click the Local File and select Properties.
• Under the “Settings” tab, select the desired logging features.
• Under the “Local File” tab, make sure the Log File Format is set to IAS Format and set the duration to keep the log entries for.
Step 6: Configuring passwords for reversible encrypted format to support EAP-MD5. This step is required due to the way passwords are handled using EAP-MD5.
• From the “Active Directory Users and Computers” menu option, right-click the name of your Active Directory domain and select Properties.
• From the Properties screen, select the “Group Policy” tab. Highlight the “Default Domain Policy” and click on the “Edit” button.
• Under the “Computer Configuration/Windows Settings/Security Settings/Account Policies/Password Policy” tree, set the “Store password using reversible encryption…” to Enable.
Step 7: Enable “Dial-In” access and “Password Reversible Encryption” for user accounts.
• After the account is created, double-click on the user account to display the user account Properties.
• Under the “Dial-In” tab, click on the “Allow Access” radio button for Remote Access Permission.
• Under the “Account” tab, check the “Store password using reversible encryption” option.
CONFIGURE REMOYRE ACCESS POLICY
Using the Remote Access Policies option on the Internet Authentication Service management interface, create a new VLAN Policy for each VLAN Group defined in the previous step. The order of the remote access policies is important. The most specific policies should be placed at the top of the policy list and the most general at the bottom. For example, if the Day-And-Time Restriction policy is still present, it should be moved to the bottom or deleted to allow the VLAN Group policies to take precedence.
• Right click Remote Access Policies and select New Remote Access Policy.
• Enter a Policy Friendly Name that describes the policy. Each Remote Access Policy will be matched to one VLAN Group. An example may be, “Allow - VLAN 10 Policy”. Select the “Next” button to continue.
New Remote Access Policy for VLAN Group
• The Conditions Window will be displayed. Select “Add” to add the condition that this policy will act on.
• Select the “Windows-Groups” attribute type and click on the “Add” button.
• The Groups window will be displayed. Click on the “Add” button and select the VLAN Group that matches this new policy. Only one VLAN Group should be associated with each policy.
• Select the “OK” and “Next” options in the next few screens to accept the group value.
Adding VLAN Group
• On the Edit Dial-In Profile screen, select the “IP” tab and check “Client may request an IP address” to support DHCP.
• On the Edit Dial-In Profile screen, select the “Advanced” tab. The current default parameters returned to the Foundry device should be Service-Type and Framed-Protocol.
• Select the “Add” button to add the additional three RADIUS VLAN attributes required for 802.1X Dynamic VLAN Assignment.
Connection Attributes Screen
• The RADIUS Attribute screen is displayed. From this list, three RADIUS attributes will be added:
o Tunnel-Medium-Type
o Tunnel-Pvt-Group-ID
o Tunnel-Type
Tunnel-Medium-Type
• Select Tunnel-Medium-Type and click on the “Add” button.
• On the Multivalued Attribute Information screen, click on the “Add” button.
• The Enumerable Attribute Information screen is displayed. Select the “802” value from the Attribute Value drop down box.
• Select “OK” to accept the value.
• Return to the RADIUS Attribute Screen
Tunnel-Pvt-Group-ID
• Select Tunnel-Pvt-Group-ID and click on the “Add” button.
• On the Multivalued Attribute Information screen, click on the “Add” button.
• The Attribute Information screen is displayed. Enter the correct VLAN ID or Name for this policy. Users belonging to the VLAN Group specified in this policy will be assigned to the VLAN ID specified.
• Select “OK” to accept the value.
• Return to the RADIUS Attribute Screen
Tunnel-Type
• Select Tunnel-Type and click on the “Add” button.
• On the Multivalued Attribute Information screen, click on the “Add” button.
• The Enumerable Attribute Information screen is displayed. Select the Virtual LANs (VLAN) option from the Attribute Value drop down box.
• Select “OK” to accept the value.
• Return to the RADIUS Attribute Screen and select the “Close” button.
802.1X的认证体系分为三部分结构：
1、Supplicant System，客户端(PC/网络设备)
Supplicant System——— Client（客户端）是—需要接入LAN，及享受switch提供服务的设备（如PC机），客户端需要支持EAPOL协议，客户端必须运行802.1X客户端软件，如：802.1X-complain，Microsoft Windows XP
2、Authenticator System，认证系统
Authenticator System——— Switch （边缘交换机或无线接入设备）是—根据客户的认证状态控制物理接入的设备，switch在客户和认证服务器间充当代理角色（proxy）。 switch与client间通过EAPOL协议进行通讯，switch与认证服务器间通过EAPoRadius或EAP承载在其他高层协议上，以便穿越复杂的网络到达 Authentication Server （EAP Relay）；switch要求客户端提供identity，接收到后将EAP报文承载在Radius格式的报文中，再发送到认证服务器，返回等同； switch根据认证结果控制端口是否可用；
3、Authentication Sever System，认证服务器
Authentication server ———（认证服务器）对客户进行实际认证，认证服务器核实客户的identity，通知swtich是否允许客户端访问LAN和交换机提供的服务Authentication Sever 接受 Authenticator 传递过来的认证需求，认证完成后将认证结果下发给 Authenticator，完成对端口的管理。由于 EAP 协议较为灵活，除了 IEEE 802.1x 定义的端口状态外，Authentication Server 实际上也可以用于认证和下发更多用户相关的信息，如VLAN、QOS、加密认证密钥、DHCP响应等。
基本的认证过程：
1、认证通过前，通道的状态为unauthorized，此时只能通过EAPOL的802.1X认证报文；
2、认证通过时，通道的状态切换为authorized，此时从远端认证服务器可以传递来用户的信息，比如VLAN、CAR参数、优先级、用户的访问控制列表等等；
3、认证通过后，用户的流量就将接受上述参数的监管，此时该通道可以通过任何报文，注意只有认证通过后才有DHCP等过程。
EAPOL协议的介绍
1、IEEE 802.1x定义了基于端口的网络接入控制协议，需要注意的是该协议仅适用于接入设备与接入端口间点到点的连接方式。 为了在点到点链路上建立通信，在链路建立阶段PPP链路的每一端都必须首先发送LCP数据包来对该数据链路进行配置。在链路已经建立起来后，在进入网络层协议之前，PPP提供一个可选的认证阶段。而EAPOL就是PPP的一个可扩展的认证协议。
2、下面是一个典型的PPP协议的帧格式：
Flag Address Control Protocol Information
当PPP帧中的protocol域表明协议类型为C227(PPP EAP)时，在PPP数据链路层帧的Information域中封装且仅封装PPP EAP数据包，此时表明将应用PPP的扩展认证协议EAP。这个时候这个封装着EAP报文的information域就担负起了下一步认证的全部任务，下一步的EAP认证都将通过它来进行。
3、一个典型的EAP认证的过程分为：request、response、success或者failure阶段，每一个阶段的报文传送都由Information域所携带的EAP报文来承担。
EAP报文的格式为：
|Code|Identifier|Length|Data|
1）Code域为一个字节，表示了EAP数据包的类型，EAP的Code的值指定和意义如下：
Code＝1————→Request
Code＝2 ————→Response
Code＝3 ————→Success
Code＝4 ————→Failure
2）Indentifier域为一个字节，辅助进行request和response的匹配————每一个request都应该有一个response相对应，这样的一个Indentifier域就建立了这样的一个对应关系————相同的Indentifier相匹配。
3）Length域为两个字节，表明了EAP数据包的长度，包括Code,Identifier,Length以及Data等各域。超出Length域范围的字节应该视为数据链路层填充（padding）,在接收时应该被忽略掉。
4）Data域为0个或者多个字节，Data域的格式由Code的值来决定。
当code域为1或者2的时候，报文格式为
|Identifier|Length|Type|Type Date|
Code Type域的说明如下：
Type域总共分为6个值域，其中头3种Type被认为特殊情形的Type，其余的Type定义了认证的交换流量。Nak类型仅对Response数据包有效，不允许把它放在Request中发送。
Type＝1————→Identifier
Type＝2————→Notification
Type＝3————→Nak（Response Only）
Type＝4————→MD5-Challenge
Type＝5————→One-Time Password (OTP)
Type＝4————→Generic Token Card
|