Wired 802.1X Across a Hospital With Unpatchable Pumps
A 980-bed hospital has 42 IDFs and 11,000 access ports and is under an audit finding requiring authenticated wired access. A discovery scan found 6,200 endpoints in the CMDB and 1,900 MAC addresses that are not - infusion pumps, nurse-call handsets, HVAC controllers, label printers and vendor laptops. About 30% of ports are patched but unused. Roughly 400 infusion pumps cannot do 802.1X and their firmware is vendor end-of-life, so no supplicant can be added. Clinical areas tolerate no unplanned downtime between 06:00 and 18:00. The identity team can deliver RADIUS, and the switch estate supports MAB, profiling and downloadable ACLs. The audit committee wants enforcement in nine months.
1. Give the deployment sequence and explain why profiling and MAB must precede enforcement.
Read the worked answer
Sequence:
- Reconcile the CMDB against switch MAC tables and DHCP/LLDP/CDP data; every one of the 1,900 unknown MACs gets an owner and a device class.
- Stand up RADIUS and certificates for managed endpoints (domain laptops, clinical workstations).
- Turn on profiling in monitor mode with open authentication across all 42 IDFs; collect for at least 30 days to catch devices that only appear monthly.
- Author policies and exception groups from that data.
- Pilot two non-clinical floors, then low-risk device classes, then clinical areas in 18:00–06:00 windows.
Why monitor before enforce: enforcement assumes you know every identity on the port. You do not - 1,900 MACs are unaccounted for, and an infusion pump that fails authentication becomes a patient-safety event, not a ticket. Monitor mode also reveals which of the 30% unused ports are actually live for a device that appears once a quarter. Profiling converts MAC addresses into device classes, which is what MAB rules must key on; without it, MAB is a guess written as a whitelist.
2. What do you do with the 400 pumps that cannot authenticate and cannot be patched? Compare the options.
Read the worked answer
Option A - MAB with a static MAC allow-list. Works with no supplicant. Weaknesses: MACs are spoofable, the list drifts as pumps are swapped by clinical engineering, and a swapped pump becomes an outage. Requires a change process you must actually enforce.
Option B - Closed-mode authentication with a restricted VLAN. Switch authenticates the port to an ACL-limited VLAN without the device participating, so the pump reaches only its management server. No supplicant needed, no MAC list. Requires switch support and careful ACL design; a mis-scoped ACL silently breaks pump telemetry.
Option C - Dedicated device VLAN with an ACL to the management server, no 802.1X. Simplest and most robust for EOL devices, but the port itself is unauthenticated.
Recommend a hybrid: Option C as the base (device VLAN, ACL permitting only the pump management server and NTP, port-security max-one-MAC sticky, all unused ports disabled), with Option A layered on for any pump that shares a switch port. Document the compensating controls: physical port control, network-enforced restriction, and monitoring for MAC changes on pump ports. Clinical engineering must sign the residual risk in writing.
3. Define the rollback triggers and the numeric success criteria for moving from monitor to enforcement.
Read the worked answer
Advance criteria (all must hold per floor):
- Unknown MACs at or below 0.5% of active ports over 14 consecutive days.
- Every critical device class on the floor profiled and assigned a policy.
- Helpdesk script and on-call rota tested with a live simulated failure.
- A pre-staged revert config on every switch, executable in under 5 minutes.
Rollback triggers (any one):
- More than 5% of a floor's endpoints landing in the auth-fail VLAN.
- Any clinical device class failing within a shift.
- Two or more unexplained helpdesk tickets per 100 ports in the first hour after enforcement.
Mechanics: enforce only in 18:00–06:00 windows with two engineers on the call, stop and revert the whole floor - not individual ports - if a trigger fires, and hold enforcement for 24 hours after any revert. Report advancement to the audit committee floor by floor; a schedule that slips is acceptable, an outage is not.