Network Edge Protection and 802.1x
12/13/2007 Update for ITAC-NI

This page outlines UF CNS approach to protecting the network at the edge. These include the related topics of port security, storm control, and 802.1x. Edge ports are also referred to as access or data ports. 
Rationale and Approach
Why is this Important?
To improve overall network availability, reduce manpower required to maintain an enterprise network (35,000 ports), and to identify small problems that may go unnoticed and generate unfavorable impressions on network performance. This is also a precursor to an eventual BlueSocket system replacement based on 802.1x or other out-of-band authentication mechanism, which will provide greater robustness and scalability for authenticated ports. 
Early Experience
Deployment began on a pilot basis in late Fall 2006 and proceeded until Sept. 2007. Individual Local Administrators were consulted on these changes as they occurred during the Wall-Plate rollout. This project turned out to be more difficult than anticipated. Local administrators were supportive, but there were some concerns. 
Technology Description
Network Edge Protection encompasses several related technologies as listed below. 
Port Security
•	Used to prevent loops that spanning tree would not detect. One common example is a misconfigured notebook with wireless bridging enabled. Another would be a switch that filters and does not generate BPDUs (Linksys). These can go undetected for a while if the effects are minimal, or they can be extreme and affect multiple buildings across the core.
•	Used to prevent abuse at the edge.
•	Violations occur when: 
o	More than 16 MAC addresses are present on the interface 
o	Duplicate MAC addresses are received from more than 1 port. Provides MAC address level anti-spoof of the router and other important systems.
•	Set to automatically recover after 15 minutes once being tripped. This could be lowered to 5 or 10 minutes.
•	Recent switch software will allow shutdown on a per VLAN basis. This will maintain VoIP phone connections when the host connected thru the phone switch trips port security. 
Storm Control
•	Used to prevent loops with excessive pps that spanning tree would not detect.
•	Used to protect networks against faulty equipment.
•	Used to protect networks against DoS attack.
•	Violations occur when.
o	Broadcast exceed 5000 pps 
o	Multicast exceed 75000 pps 
o	Unicast exceed 75000 pps 
•	Set to automatically recover after 15 minutes after being tripped 
•	Desire is to target this at edge workstation ports, challenge is how to identify workstation versus server ports. 
•	Imaging, such as Ghost and VMware migration, is known to cause false hits due to brief bursts of traffic.
DHCP Snooping
•	Recommended but not mandatory.
•	Works very well if CNS is informed of any DHCP server changes.
802.1x
•	Still in planning stages 
•	Would provide Gatorlink authentication to the network without using authentication servers.
•	Would shift load away from authentication servers. 
•	Does not replace good host security.
•	Challenges 
o	Windows supplicants do not work well. UF may need to buy a 3rd party supplicant.
o	Supplicant on other OSes are also a concern.
o	Nightly automated activities to the edge host (backups, security updates) 

Problem Details
These are examples of actual problems encountered during our extensive field trials. They are grouped according to the cause. 
External Network Devices (Hubs and Switches)
Most port security errors were due to external network devices allowing multiple hosts on a single edge port. The majority of these occurred when the MAC address limits were low i.e. 3-5. 
Rapid physical changes on the same edge switch
There is a 5 minute window (timer, not adjustable) that prevents duplicate MAC addresses from appearing on the network. If a user moves a host from a port on a VoIP phone to another port on that same edge switch, then port security will trip due to duplicate MAC address detected. These issues may be solved someday by Cisco. The same behavior would occur for external network devices, but these will never be solved.
Marvel NICs
Marvel LAN card cards trip port security by putting duplicate MAC addresses on the network. This is broken behavior and not a Cisco bug. This can be circumvented by turning off 802.1x on these hosts which can be done via GPO. There also may be a new NIC driver someday that fixes this. 
VMware Servers
A VMware server configuration that is copied to create a new server must have its configuration altered to change the MAC address or the address will show up twice tripping port security. This would likely cause serious issues even if port security was not in place.
ESX VMware servers that have 2 NIC cards for failover will trip port security since the same MAC address would be used on both ports during failover. Port security must be disabled for these redundant servers.
A VMware server that is running more than 15 instances would trip port security, but this should not normally happen. 
Walkup and other General Use Ports
There are occasional port security errors at Walkup ports which could not be verified due to the transient nature of the users. These may have been laptops with bridging enabled.
What are the Next Steps?
Deployment has been Paused for Now
CNS has enough ports deployed in the field to constitute a good cross section of UF's networks and the nature of edge network events. These buildings may have port security removed pending further discussion here and with the CIO or we may decide to move forward.
Continue Troubleshooting Problems to Increase Understanding
CNS will issue feature requests to Cisco for more granularity in storm control and port security, and also watch for overall technology improvements including Marvel NIC updates, and new supplicants. 
User Education and Outreach
The User community needs to be educated about proper ways to connect to the network, and made aware of specific pitfalls. This will be supported by point of install consultations as well as emails and public web pages. 
•	A network user manual is needed for local administrators. This will include why this is good, what not to do, and how to report/circumvent problems. 
•	Automatic emails should be sent to local administrators from logging alerts. This should be possible within the next few months.
Need specific ITAC-NI recommendation on 2 main points:
Should external network devices (hubs and switches) be allowed beyond the Wall-Plate?
There are local budget implications since building wiring is the local unit’s responsibility. What should be CNS’s response once a prohibited device is detected? If the local units are allowed to have these devices, then they should be reminded that any security event seen on that CNS edge port may lead to disabling all traffic thru that port.
Should Port Security be deployed once user notification systems are ready or should we wait for more improvements from vendors?
Are the benefits worth the inconveniences? CNS could use a data mining technique to detect external network devices once they are connected, but this will fail to protect the network from the largest impacts.