Experiences from the JANET(UK) 802.1X supplicant trial

Transcription

1 Experiences from the JANET(UK) 802.1X supplicant trial Networkshop 36 Dr Alan Buxey IT Services Specialist, Network & Security, Loughborough University

2 Outline of presentation Background information on CfP OpenSEA. What is It? How the trial operates The supplicant issue Current progress Roadmap 802.1X - Where? When?

3 Background information Call for Proposals for 802.1X 15 th June Deadline July 2007 Deliverable Nov

4 CfP details - objectives Establish a lead site to co-ordinate testing. Test the initial beta supplicant releases. Provide structured feedback to OpenSEA Foundation developers. Track identified bugs and test the subsequent fixes released. Document experiences in the form of case studies and deployment guides Produce install and configuration guides. Produce administrator guide (Include configuration). Support project partners in installation and testing. Provide active bug fixing and support for roll out in the first two years. Provide a framework for supporting the supplicant.

5 Results of CfP 8 sites in the trial Loughborough University (lead technical site) Oxford Brookes University STFC Daresbury Laboratory University of Bristol University of Edinburgh University of Liverpool University of Southampton University of Swansea

6 OpenSEA what is it? SEA = Secure Edge Access Open standard for this arena Founding members: Extreme Networks, Identity Engines, Infoblox, Symantec, TippingPoint, and Trapeze Networks. Plus UKERNA Aruba Networks and Hewlett-Packard joined recently as promoter members NB lack of certain names

7 OpenSEA provides Xsupplicant Plugin ability eg idengines NAC A unified supplicant. Multiplatform. Result of the Enterprise Strategy Group the firefox of 802.1X clients (eventually!)

8 How the trial operates Mailing list Direct contact at Loughborough WIKI Video Conferencing Green Agenda Teleconference Meetings at places such as Networkshop NB BoF session

9 The supplicant issue Experience within the educational sector suggests that the IEEE 802.1X client (or supplicant ) supplied by Microsoft with Windows XP and Vista has some significant limitations which are impeding adoption of IEEE 802.1X within the community both in the context of the JRS and network admission applications in general. This is the so-called supplicant problem Other issues too :- Only does PEAP/EAP-TLS So many different supplicants with various functionality Configuration difficulties. Standard config/template?

10 Screenshots of various supplicants

11 Screenshots of various supplicants pt2

12 Screenshots of various supplicant.ad infinitum Lots of different layouts and methods Some configurable. Others not so! Some additional addons eg SecureW2

13 Current progress Started with v now on v revisions including major revision jump Uncovered bugs not a surprise Uncovered shortcomings issues Creation of prioritized list of show stopping bugs and feature requirements

14 Bugs/features Handling of certificates Handling of removable interfaces WPA-PSK issues.. No setup wizard, no easy-link Mobility issues Admin kit have created a wrapper Some service/gui interop issues

15 WIP Bugs are being fixed Sites are finding and reporting issues Can handle the basic task Getting more recent builds

16 Roadmap (public)

17 Roadmap (public)

18 802.1X Where? When? Everywhere! Wireless and Wired AAA compliancy with auditors etc Real control Access Control etc for management Now. Used in RESNET systems and most centralised wireless Flexibility multiple uses from one system NAC being introduced needs EAP.

19 802.1X enables.

20 Questions Questions and Comments Please note, there is an 802.1X BOF later today!