Network Security

Enterprise Network Access Control (NAC) Deployment

Royal Media Services | Internship Project, 2026

PacketFence Cisco IOS IEEE 802.1X RADIUS Active Directory / LDAP

Executive Summary

The Challenge: Large enterprise networks are vulnerable to rogue devices. Employees or guests plugging unauthorized laptops or access points into corporate ethernet ports can bypass perimeter firewalls and gain direct access to the internal LAN.

The Solution: I proposed and successfully implemented a strict, identity-driven Network Access Control (NAC) architecture. Using PacketFence, I bridged the gap between the physical Cisco networking hardware and the company's existing Active Directory.

The Impact: Network ports are now dynamically secured. If an unauthorized device connects, it is isolated into a dead-end VLAN. Authorized staff can authenticate using their existing company credentials, automatically provisioning their port to the correct corporate VLAN without manual IT intervention.

Architecture Topology

sequenceDiagram participant Device as Client Device participant Switch as Cisco Switch (Authenticator) participant PF as PacketFence (RADIUS) participant AD as Active Directory (LDAP) Device->>Switch: Device plugs into port Switch->>Device: Request Identity (EAPOL) Device->>Switch: Sends AD Credentials / MAC Address Switch->>PF: RADIUS Access-Request PF->>AD: LDAP Bind (Verify Credentials) AD-->>PF: Authentication Success PF-->>Switch: RADIUS Access-Accept + VLAN ID Switch->>Device: Port Authorized & Assigned to Corporate VLAN

Logical flow of 802.1X / MAC Authentication Bypass

Technical Implementation (Deep Dive)

1. Cisco Switch Configuration (802.1X & MAB)

To enforce access control at the edge, I configured the Cisco access switches to act as 802.1X Authenticators. The ports were configured to drop all traffic except EAP (Extensible Authentication Protocol) until identity verification is complete.

Because not all devices support 802.1X supplicants (e.g., printers, IP phones, legacy broadcasting equipment), I implemented MAC Authentication Bypass (MAB) as a fallback. If a device times out on EAPOL requests, the switch passes its MAC address to the RADIUS server for verification against a known hardware whitelist.

2. PacketFence & Identity Integration

PacketFence was deployed as the central policy engine and RADIUS server. I integrated it directly with Royal Media Services' Windows Server Active Directory via LDAP.

This allowed me to map AD Security Groups directly to network access policies. For example, a user in the AD_Broadcasting group would be evaluated by PacketFence and dynamically assigned a specific RADIUS attribute corresponding to the Broadcasting VLAN.

3. Dynamic VLAN Assignment & Change of Authorization (CoA)

A core requirement was handling unregistered but legitimate devices (like a contractor's laptop). I utilized an isolated Registration VLAN that routes strictly to a PacketFence Captive Portal.

Once a user inputs valid AD credentials into the portal, PacketFence triggers a Change of Authorization (CoA - RFC 5176) request to the Cisco switch. The switch dynamically tears down the active session on the port, flips the port from the Registration VLAN to the Corporate VLAN, and forces the client to renew its DHCP lease—all without requiring a physical port reset or IT ticket.

Interested in discussing infrastructure security?

Get In Touch