A FAUCET-driven Network
Access Control Solution
It’s not wise to upset a Wookiee

Problem●●●●●

Limit Access to Network Resources
Credential-specific Resource Restrictions
Deployable Across the Network
Working in an SDN Environment
No Current NAC Solution for Faucet

What is Chewie?
Chewie is:● EAP / 802.1x Authenticator● Speaks RADIUS to Authentication Server● Speaks EAPoL to Supplicant devices● Provides Credential-based Access Controlfor Faucet

Why Deploy Chewie?
●●●
●
●
●

Protect LAN Resources
Credential-specific Policies
Support for all major EAP-methods (in theory)
IoT Support with MAB
Easy to Deploy in Faucet Networks
Fine-Grained Access Control

BackgroundGlossary
EAP - Framework for Authentication Protocols
Ensuring common functionality and negotiation of EAP methods
EAP Method - The method used to achieve authentication. (EAP-TLS, PEAP, ...)
NOTE: This is not a line-protocol and must be encapsulated
EAPoL - Line-Protocol for Encapsulating EAP-methods over IEEE 802
RADIUS - AAA Protocol with EAP Support for Authentication
Mac Authentication Bypass (MAB) - MAC-based Authentication provided by802.1x AuthenticatorChewie’s Power●●●●RADIUS-Powerhouse
Translate EAPoL ➜ RADIUS
Radius Performs EAP Methods
Avoid Complex CodeUser Management

Storing Credentials● Credentials are Stored in RADIUS● Can be backed by LDAP
● Users have Restriction Policies AttachedStoring Credentials - RADIUS

Providing Filter Policies● RADIUS Provides AAA Attributes○ IETF 64 - Tunnel Type○ IETF 81 - Tunnel Private Group ID○ IETF 11 - Filter-Id

Used for Allocation of Dynamic VLANs and ACLs on AuthenticationEventAuthentication Overview

Performing EAP Authentication
EAP Authentication (Supplicant Software Required)

In Practice?

What about IoT?
Not all Clients are able to perform EAP Authentication
Why build a secure network if we must open ports for phones /printers?
No ‘extra’ Client Software Required

Mac Authentication Bypass
MAC-based Authentication performed by 802.1x AuthenticatorNo ‘extra’ Client Software Required

In Practice?
DHCP Packet is Received by the Authenticator
MAC Address is copied from DHCP Request and Sent to RADIUS
Server as Access-Request
Result is Received by the Authenticator to Authorise Port

Chewie ArchitectureNetwork Layout● NFV Port
● Connected to Faucet
using Callbacks / Events (BAD)● Future development forgRPC connection (GOOD)● Allow for both 802.1x andnon-802.1x PortsFaucet - Chewie API
Faucet ➜ Chewie● Port Up● Port Down
Chewie ➜ Faucet● Successful Auth Event● Failed Auth Event● Logoff Event

Granular Access Control

Providing Filter Policies● RADIUS Provides AAA Attributes○ IETF 64 - Tunnel Type○ IETF 81 - Tunnel Private Group ID○ IETF 11 - Filter-Id

Used for Allocation of Dynamic VLANs and ACLs on Authentication
EventAllocation of VLANs / ACLs
Chewie supports deployment of ACLs based on user credentials
Default ACLs for all users
VLAN allocation based on credential

No ‘downloadable ACLs’Chewie Notes:
Chewie:● can run independent of Faucet● is a different project from Faucet● currently MUST run on Controller Device due to API restrictions

Using Chewie

Chewie Configuration● Configuration is achieved through the Faucet.yaml file
● Options include:○○○○

RADIUS ServerDefault ACLs for Managed PortsNFV Port Location
Marking Ports as Chewie-Managed

NOTE: Faucet Configuration is NOT Changed by Chewie

Getting Set Up
1. Ports are Marked with dot1x
2. Relevant Flows are Created
3. All EAPoL Traffic is forwarded to NFV
All other Traffic is Denied
4. Port is Opened on Successful Auth

Try it Yourself?

Starting with Chewie

Use Docker...

Seriously…
`cd ./chewie && docker-compose up --build`If You’re Interested
There are a number of example configurations available in theFaucet Documentation, describing how to introduce Chewie into aFaucet network.
https://readthedocs.org/projects/faucet/
Chewie also has developer documentation available below:
https://readthedocs.org/projects/chewie/

Adding to a Faucet Deployment
Chewie required the following to be defined in the config file:● Dot1x section under Data Plane section● (At least) 1 Port Marked with Dot1x flag

FAUCET will know to run Chewie if defined correctly

Example Base Configuration

Logging / Debugging Network
Verbose Logging in Chewie
Logs are Added to the Faucet Log
All Events are logged in Chewie, including port_up, port_down,authentication_attempts, and all packets received and set arelogged.

If You’re Stuck - Contact Us
There are a number of mailing lists available to help:
faucet-users@lists.geant.org
faucet-dev@list.waikato.ac.nz
faucet-announce@list.waikato.ac.nz
faucetapps-dev@list.waikato.ac.nz

Overview

Achieved Goals
Applying User-Based Access Restrictions
Providing Port Security for ‘Dumb’ Clients
No Vendor-Specific Requirements

The Dream that Failed (so far…)
Building Dynamic ACLs from RADIUS Attributes

Plead for Developers
Implement Co-Processor Compliance
Maintain State on Restart
Integration with Faucet Agent and gRPC / Protobuffers forabstraction
Traverse Multiple Switches to an NFV port
Encrypted Channels using NFV Co-Processors

Questions?
About MeMichael Washer
Masters Student in Cyber Security
WAND - Waikato University
https://github.com/MichaelWasher/https://www.linkedin.com/in/michael-washer/