Friday, May 14, 2021

802.1X and non-computer devices

I work for a manufacturer that makes devices that plug into customer's networks (similar to IP Phones). We currently don't support 802.1X on any of our devices, however it's come up recently from a few customers that they're looking at making that a requirement in the future.

From an enterprise network operations perspective, how are devices that support 802.1X typically handled? Do you issue unique certificates to each device, and if so, how do you handle renewing those certificates over the long term? Or do you just implement MAC Authentication Bypass (MAB) for these devices (and all the other devices that don't support 802.1X), and not bother managing the individual certificates on the devices?

Obviously on 'full' computers, you have tools (Group Policy, MDM, etc.) that can be used to push/renew certificates, and setup the supplicant automatically. That's something that's not typically available on these network devices. Other devices I'd assume this would also be a challenge for would include:
IP Phones
Printers
Cameras
TVs
etc.

How is this handled in the 'real world'?



No comments:

Post a Comment