802.1X Fallback Causing Unauthorized Access
A financial firm deploys Aruba CX switches with 802.1X and MAC authentication fallback. Ports are configured with 'aaa authentication port-access mac-auth' and 802.1X. A printer that does not support 802.1X authenticates via MAC auth and is placed in the 'printer' role. An attacker plugs a laptop into an unused wall jack in a conference room. The laptop's MAC is not in ClearPass, so MAC auth fails. The port is configured with a 'critical' VLAN fallback that places unauthenticated devices into VLAN 30, which has internet access and can reach a guest portal. The attacker uses the guest portal to obtain limited access, then exploits a vulnerability in a conference room IoT device on the same VLAN to pivot.
1. Identify the design weaknesses that allowed the pivot.
Read the worked answer
Two weaknesses: (1) The critical/fallback VLAN (VLAN 30) grants network access to any unauthenticated device, effectively making the port open. Fallback VLANs should be tightly restricted (e.g., only to a captive portal, no lateral access) and ideally not used on ports where 802.1X is expected. (2) The guest/IoT VLAN permitted device-to-device lateral traffic, allowing the attacker to reach the IoT device. Segmentation should isolate guest and IoT devices with ACLs preventing peer-to-peer traffic. Additionally, unused ports should be administratively disabled or placed in a blackhole VLAN. MAC auth as a fallback for printers is reasonable, but it must not create a general bypass.
2. What configuration changes would you make to harden the environment?
Read the worked answer
Disable unused ports or assign them to an isolated blackhole VLAN. Restrict the fallback VLAN so it only permits traffic to the captive portal/DHCP/DNS, with an explicit deny for all other destinations. Apply role-based ACLs to the guest and IoT roles that deny intra-VLAN peer traffic (e.g., deny ip any 10.30.0.0/24 within the VLAN, permit only required services). Enable port-security features such as MAC limiting and DHCP snooping/ARP inspection. For printers, use MAC auth but bind to a specific role with minimal access. Validate by plugging an unknown device into an unused port and confirming it receives no usable network access beyond the portal, and by testing that guest devices cannot reach each other.