Dot1x, PXE and NAP

Question

Hi Guys,
Got a question:
Trying to setup dot1x in an environment using Citrix Provisioning server.  This involves the following process:
1. Workstation boots up using DHCP/Bootp, gets assigned an IP Address
2. Downloades Desktop image
3. Loads Workstation Image (Windows 7 Desktop)
From a dot1x perspective this is what we get:
1. Non-authenticated startup because it is using PXE there is no dot1x supplicant - port is assigned to a guest VLAN
2. When the image is loaded the LAN card is restarted and the Windows 7 Client has dot1x supplicant
3. Dot1x supplicant attempts authentication with either a pass or fail result.
4. Authentication success port is enabled, authentication fail quarrantine vlan is assigned.
Unfortunately we haven't been able to get this to work on the cisco switches because when the workstation moves from an non-authenticated startup (the guest VLAN) and is moved into an authenticated port that is enabled and goes to the main VLAN the workstation fails to complete startup because the change in VLAN interrupts the streaming to the Citrix provisioning server.  As far as we understand for this boot process to work the workstation needs to remain in the same VLAN.
We tried to work around this by using per user ACL's however this doesn't work because if we don't configure a Guest VLAN for non-authorised ports, the port is disabled.  We can't configure the Guest VLAN to be the same as the Primary VLAN of the port as this stops dot1x from authenticating the port.
Has anyone got a solution for this scenario.  Is there a way to configure per user ACL's using dot1x which allows a non-authorised port be be enable but allow us to assign a per user acl to the port for authorised machines?  The solution that is most likely to works is one that doesn't involve the use of different VLAN's execpt for perhaps a remediation VLAN for authorisation failed machines.
I hope this make sense and I hope there is someone out there that can help.
Regards,
He-Wun Kim

Answer 1

Hi,
We don't want to change the VLAN the main issue is that we can get the authentication to work i.e.:
The workstation using PXE boots up in the non-authenticated guest LAN, which has access to the provisioning servers, the image is downloaded and then loads.
The operating system boots up and successfully authenticates using Microsoft NAP as the supplicant, and is assigned to the port is authorized.
The problem is that the Guest VLAN and Authorized VLAN which is the default VLAN that the port is configured to be a part of are obviously on different IP subnets and the workstation as part of the process gets a new IP Address assigned when the Operating System boots, it is this CHANGE of vlan that breaks the provisioning process  the VLAN port membership cannot change in order for the solution to work.  We tried configuring the following using Radius VSA in which the Radius Server supplies the access-list name/number to use:
No Guest VLAN - The result, the PXE boot fails because the port is disabled when there is no dot1x authentication attempt made
Guest VLAN and Authorised VLAN the same - Fails because the switch doesn't allow this configuration authentication is disabled
Again the problem we have is that we are going from a non-authenticated to authenticated mode on the workstation, and there doesn't appear to be away to have the same workstation to remain on the same subnet for the duration of the boot and provisioning process.
We have looked at the MAC authentication option (which is what Citrix recommends) but we do prefer to use NAP/dot1x as it performs a number of health checks which are extremely useful in keeping our network nice and secure.
Regards,
He-Wun Kim