Mac to VLAN mapping on Cisco switches

Hello,

We are looking at ways to ease management of VLANs, and secure on basis of MAC address (yes I know, easily spoofed).

After much googling, it seems that:

- 802.1x has the potential to do what we want, but always needs a supplicant (agent) on the connecting device. As too many devices we use (a.o. thin clients) do not have this capability, this is out for now[1]. Am I correct that for MAC based 802.1x vlan assignment, one always needs an agent on the device?

- The other option would be VMPS. Open Source software can get the MAC/ VLAN assignment from a database[2], but can Cisco software do similar? Do they even have a dedicated VMPS server, or is one stuck with downloading a file to the master switches?

I hope I'm wrong, too many sites say that VMPS is deprecated in favor of

802.1x. But requiring an agent on the end device is quite a big step. Why is there no middle ground between these two?

TIA, M4

[1] We'll be switching to 802.1x capable thin clients soon, so it may not be out completely. [2] Think CMDB. Not in CMDB => No access. In CMDB => department and requesting switch dictate VLAN.

Most modern OSs have this built into the networking stack. Ie. Windows7/Mac OSX/Linux all do. I can't tell about your thin clients.

VMPS was never fully supported by Cisco in the first place. Rumor was that some large customer wanted a solution (this was long before .1x) and cisco half-heartedly built something in. The VMPS server ran in a 6500 switch, there never was general server code outside of switch hardware..

To say it is insecure is an understatement. Sniff, spoof and any VLAN hopping instantly done.

Since .1x, whatever supported level of VMPS existed vanished, and it is kept around mainly in the platforms that had it just in a holding pattern.

But, are you over generalizing this as a solution? There haven't been many locations where I'd even consider .1x. To me, it is a specialized solution to begin with.

It all sounds neat, just edit radius to assign VLAN, but in reality, it is even easier to keep track of switch ports and edit which VLAN a given switch port is in and hard code it there. No security issues, no having to run extra stuff. I'd say 99.99% of the situations in which I find myself that this is the standard setup.

keeping track of switch ports is easier than dealing with usernames and passwords.