Wired Access Deployment Planning

Applies To: Windows Server 2008, Windows Vista

Before you deploy wired access, you must plan the following items:

  • Switch acquisition and installation.

  • Client network and security configuration.

Planning switch acquisition and installation

When you design your network access solution, you must determine which brand and model of 802.1X-capable switch can best meet your needs. For secure deployments, the switches that you deploy must support several specific standards, and provide specific security features. After you have determined which brand and model of switch you need, you must determine how many switches your wired access deployment requires. Finally, you must install the switches on your network, and configure the necessary security and network settings.

Verify switch support for standards

For consistency and ease of deployment, it is recommended that you purchase 802.1X-capable switches of the same brand and model.

The 802.1X-capable switches that you deploy must support the following:

  • IEEE 802.1X

  • Remote Authentication Dial-In User Service (RADIUS) authentication

In addition, to provide enhanced security for the network, the 802.1X-capable switches must support the following filtering options:

  • DHCP filtering

    The switches that you deploy on your network must filter on IP ports to prevent the transmission of Dynamic Host Configuration Protocol (DHCP) broadcast messages in those cases in which the client is a DHCP server. The switch must block the client from sending IP packets from UDP port 68 to the network.

  • DNS filtering

    Switches must filter on IP ports to prevent a client from performing as a Domain Name System (DNS) server. The switch must block the client from sending IP packets from TCP or UDP port 53 to the network.

Additional considerations:

If the 802.1X-capable switches require vendor-specific attributes (VSAs) or additional RADIUS attributes for special features or customized configuration of the switch, you must add the VSAs or RADIUS attributes to the wired NPS network policy on the NPS servers. If you add VSAs or RADIUS attributes to the wired NPS network policy on the primary NPS server, copy the primary NPS server configuration to the secondary NPS server.

Determine how many switches you need

Use architectural drawings to create a schematic diagram of your wired network. Determine the location of every RJ-45 Ethernet wall outlet that is connected to your wired network. For example, indicate on your diagram every RJ-45 outlet in all offices, meeting rooms, reception areas and break areas.

Using your diagram, or a physical inspection of your site, determine the number of RJ-45 wall outlets that you need to control using 802.1X-capable switches. Use this number to determine how many switches are required for your wired deployment.

According to the general naming conventions used on your network, give a friendly name to each of your switches, and then track those names in a list. For example, if you determine that your deployment requires 50 switches, you might name your switches: switch_001, switch_002, switch_003, and so forth. If your deployment has multiple wiring closets or server closets where switches are installed, update your architectural drawings to indicate — by name — the installation location of each switch.

On your diagram, mark zones that contain the same number or RJ-45 wall outlets as there are ports on a switch. Indicate on your architectural drawing — by name — which switch is associated with each zone. For example, for a switch named switch_003 that has 24 ports that are dedicated to wired client connections, mark a zone on your diagram that contains the 24 RJ-45 wall outlets that you will connect to that switch, and then mark that zone to indicate that it is associated with switch_003.


In deployments that involve multiple subnets for wired clients, it is beneficial to also indicate the IP address range and subnet mask that is used by each zone.

Next, on the architectural diagram or on a spread sheet, indicate the relationship of each RJ-45 port with each switch and switch port. For example, for a single RJ-45 outlet in office number 294, in zone 02, that will connect to port 14 on a switch named switch_02c, your records should capture information similar to the following table.

Zone Location Switch Switch Port Number

Zone 02

Office 294



Having an accurate switch and wiring diagram and related records will assist later during troubleshooting operations, when you want to upgrade or replace switches, or if you change the physical Ethernet wiring in the building.

Planning wired client configuration and access

When planning the deployment of 802.1X-authenticated wired access, you must consider several factors:

  • Planning restricted access

    Do you want to provide all of your users with the same level of access to your network, or do you want to restrict access for some of your users?

  • Adding new client computers to your wired network

    Although there are several alternatives, the preferred method adds a new computer as a member of the domain and has the configuration performed by a member of the IT staff.

Planning restricted access to the wired LAN

You might want to provide groups of users in your organization with varying levels of access to the network. For example, you might want to allow some users unrestricted access, any hour of the day, every day of the week. For other users, you might only want to allow access during core work hours, Monday through Friday, and completely deny access on Saturday and Sunday.

This guide provides instructions to create an access environment that places all of your users in one security group. You create one wired users security group in the Active Directory Users and Computers snap-in, and then make every user for whom you want to grant wired access – a member of that group. When you configure Network Policy Server (NPS) network policies, you specify the wired users security group as the object that NPS processes when determining authorization.

However, if your deployment requires support for varying levels of access you need only do the following:

  1. Follow the procedure Create a Wired Users Security Group in this guide, to create one or more additional security groups for your wired users in Active Directory Users and Computers, each security group specifying a unique name.

  2. Follow the procedure Add Users to a Wired Users Security Group to make each user a member of the appropriate security group.

  3. Finally, follow the procedure in Create NPS Policies for 802.1X Wired by Using a Wizard to configure an additional set of NPS policies for each additional wired users security group. In step 9 of the procedure, in Specify User Groups, click Add, and then type the name of the appropriate security group that you configured in Active Directory Users and Computers.

Planning methods for adding new wired clients

To add new computers to your network, the computers must first be joined to the domain. In a network that uses 802.1X authentication for IEEE 802.3 wired Ethernet connections, the preferred method to add new computers to the domain is for an administrator or member of the IT staff to join the computer to the domain by using a wired connection to a segment of the LAN that has access to domain controllers, and that is not protected by an 802.1X-capable switch. After joining the computer to the domain, the computer is distributed to the user.


Make sure that uncontrolled connections are only accessible to your IT personnel.

The steps to join computers to the domain by using a wired connection is documented in the Windows Server 2008 Foundation Network Guide, in the section titled Joining computers to the Domain and Logging On.