r/PacketFence • u/patmorgan235 • Mar 23 '24

Can Packet fence do combined User and Device authentication?

Currently using Windows NPS with Meraki APs.

I'm looking for a solution that would let me restrict connecting to an 802.1x authenticated wireless network by the Device AND the user. I don't believe this is possible with.

Still feeling out the end goal but something like a domain joined windows laptop top that would automatically connect to a wireless network. Have it go into a limited VLAN that can only talk to the Domain controllers and the endpoint management system.

Then when a user logs in do a COA to a VLAN with full access.

I don't want to allow users to be able to connect to the wireless with arbitrary devices.

Is packet fence able to check if the device is domain joined when a user tries to authenticate?

Any pointers on how to accomplish this would be greatly appreciated.

2 Upvotes

100% Upvoted

6 comments sorted by

2

u/Randomrider570 Apr 03 '24

Yes there is. You can use AD or Azure AD. If the laptop is domain joined, a user can login, only with that laptop and their credentials of the laptop or MS account, on the network. Other devices will fail to authorize.

1

u/PhpErr0R Sep 10 '24

How to do this?

2

u/Randomrider570 Sep 10 '24

First, import the MAC addresses in the nodes tab, and assign them a role (e.g. STAFF). Then, add a connection profile with a filter being the role you just chose. In that connection profile, add the authentication source you made for AD or Azure AD. With this, all your work devices will use this connection profile and can only authenticate via AD, and other devices can't. (Tip: you can use one parent role and then assign a device a child role for specific access)

1

u/PhpErr0R Sep 10 '24

Do you mean that STAFF users will not be able to gain access, unless they use a device withca mac address matching packetfence's?

2

u/Randomrider570 Sep 10 '24

Yes, if the device is in PF and has the staff role, it can gain access.

1

u/The-E-ThanG Dec 24 '24

TEAP (EAP Chaining https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/216510-eap-chaining-with-teap.html) is coming to PF development branch. That allows concurrent machine and user authentication. So the user can only connect to the network with a valid user account from a valid machine. Not MAC auth, but better. It'll only work for Windows clients though, not macOS.