Deployment Solution

Basically the issue is: " How do we make Altiris still work once we enable port-based authentication (802.1X authentication)?" Once a customer enables port-based authentication the client computers at boot-up are unable to reach the Altiris server thru PXE boot for policy download and imaging.

Here are some online articles I saw online about this issue but did not have a resolution.

https://kb.altiris.com/display...t=&catURL=&r=0.4172327.

http://networknerd.wordpress.c...8021x-networks-part-1/

FYI,

The Cisco switches are using "IP helper". This should allow the router to recognize that a machine is trying to boot from the PXE server and forward that request to the PXE server otherwise that machine will need to authenticate.

Reference: KB Article 17383 - section 4 of the resolution section discusses how to configure IP helper... (IP helper-address XXX.XXX.XXX.XXX) X= PXE server address.

Any ideas or thoughts on how to get 802.1x authentication to work with PXE?

Thanks,

Joel

Joel,
I'm a little confused by what your actually getting at here because you talk about both 802.1x and IP helper together.

You are correct that IP helper needs to be configured on the layer 3 switch/router to include the PXE server as well as the dhcp server, but that has nothing to do with 802.1x authentication.

Could you please post a copy of the switchport configuration for the interface which you are trying to re-image on.
Am I correct in assuming that you can successfully re-image from that port when you change the port configuration to force-authorized using the "no dot1x port-control" interface command?

If that is the case then things are working as expected, because the PXE boot client has not supplicant or credential information with which to authenticate. Your only option is to implement a workaround.

Cisco's answer to this problem is MAC Authentication bypass. I ran into this problem in 2005 before cisco released mac auth bypass and developed a set of Altiris scripts for the re-imaging job that dynamically changed the dot1x port control using snmp. That was documented in a 5 part blog post. You referenced part 1, but the complete script was posted in part 5. Since you say that it didn't provide a solution I assume that you either didn't get to the last part or that some part of the scripting didn't work for you.

Please post a little bit more detail on the network layout and switch/router config and I'll see what I can do to help.

Regards

Robert

The Cisco Mac Auth Bypass deployment guide can be found at http://www.cisco.com/univercd/.../solution/macauthb.pdf.