> For the complete documentation index, see [llms.txt](https://documentation.2pintsoftware.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.2pintsoftware.com/2pxe-server/4.0/configuration/ipxe-802.1x-integration.md).

# iPXE 802.1x Integration

Tools and solutions for adding new machines to secure networks.

## Overview

Customers with highly secure internal networks may choose to implement enhanced security protocols, such as 802.1x or IPsec, for machines on the corporate network.

However, this presents challenges when trying to boot a machine using iPXE for re-imaging, especially when an organization allows re-imaging throughout the enterprise (at every user’s desk), not just in protected imaging labs.

## The Challenge

The challenge is that iPXE cannot be protected or encapsulated with other security protocols. The network must allow access to:

* **DHCP –** For an IP address.
* **BootP –** to get the network boot protocol file (NBP)
* **HTTP(s) –** to download the iPXE binary from the iPXE Server.
* **ConfigMgr (if applicable) –** a CM Distribution Point
* **WinPE –** Any additional servers the WinPE client will connect to.
* File server for downloading the Install.wim
* File access to any server to initiate network level security.
* Optionally, access to the Domain Controller if a Domain Join is necessary.

If your network level security solution allows for connectivity using client-side certificates, it may be possible to incorporate the client-side certificates into the WinPE image for imaging. Consult your security software documentation for instructions on how to do this.

Work with your networking team to ensure that machines attempting to iPXE (and PXE) boot have direct access to DHCP and any BOOTP DHCP options. During implementation, your network security team might BLOCK DHCP and BOOTP options for new computers; these need to be unblocked.

The 2PXE server needs TCP access on ports 8049, 8050 and 8051, and UDP port 69 for TFTP (see [Firewall Considerations](/2pxe-server/4.0/planning/firewall-considerations.md)). It is recommended that the server be placed in a special Access Control Group for unprotected communication with any unauthenticated client.

In a Configuration Manager environment, once communication with the iPXE servers has been initiated, clients might also connect to any Configuration Manager Distribution Point (DP) to download the boot.wim file, so all DPs might need to be placed in the special Access Control Group for unprotected communication with any client.

If your security team asks the imaging team to keep the number of unprotected servers to a minimum, one solution may be to place the iPXE servers behind a load balancer, so that only ONE IP address needs to be allowed for unprotected communications.

Finally, if your security team does not allow Configuration Manager Distribution Points to be unprotected servers, or if you enable BranchCache, the client cannot download from peers unless a script gives the local client full access.

### 2Pint Tech Used

2Pint iPXE Anywhere can run PowerShell scripts on the iPXE server during the iPXE boot process.

For example, on a network protected by 802.1x, the following steps provide access:

* Place the iPXE server in an Unauthenticated Security Group with access to ports 8049, 8050, 8051 and 69.
* If you have multiple iPXE servers in a pool, you can put a load balancer in front of the iPXE servers, and only add the load balancer to the Unauthenticated Security Group.
* This allows scripts to run on the iPXE server for every client that tries to connect.
* Make an API call to your authentication server (for example, RADIUS) to make a MAC Authentication Bypass (MAB) request for each client.
* Once the MAB request has been made successfully, you might need to force an EAPOL-Start frame on the client to test for the new status on the authentication server. On iPXE, this can be done with a script that performs “ifclose” and “ifconf”.

### Works with the following MS tech

DHCP, Configuration Manager, BranchCache

### Example

This code is intended to be called from within the 2Pint iPXE Anywhere iPXEBoot.ps1 script.

It returns a script blob (string) to be passed back and injected early in the iPXEBoot.ps1 script.

Note that there is a large section of code below to handle EAPOL authentication issues. This may not be necessary with newer versions of iPXE Anywhere, due to enhancements in iPXE for EAPOL retransmission during ifconf, added in September 2023.

```powershell
# Custom handler for 802.1x exceptions 
function revoke-MyNetworkSecurity { 
    [cmdletbinding()] 
    param( $RequestStatusInfo, $DeployNetwork ) 

    "start MAB Process $( $RequestStatusInfo.DeployMac.ToString() )" | write-verbose 

    if($arrayOfNon802x1Subnets.Contains($DeployNetwork.NetworkId.ToString()) ) { 
        write-verbose "Device is not on an 802.1x network exit. $($DeployNetwork.NetworkId.ToString())" 
        return "" 
    } 

    $body = @{ 
        user = 'corp\8021xaccount' 
        password = 'P@ssw0rd' 
        mac = $RequestStatusInfo.DeployMac.ToString() -replace ':','-' 
    } | ConvertTo-Json -Compress  

    $ErrorOut = $null 
    $restOut = '' 
    try {  
        $result = Invoke-WebRequest "https://internal8021xapi:443/8021x_mab.pl?POSTDATA=$([uri]::EscapeDataString($Body))" -verbose -UseBasicParsing 
        write-verbose "Result back from https://internal8021xapi" 
        $result | out-string | write-verbose 

        if ( ( $result.StatusCode -ne 200 ) -or ( $result.RawContentLength -ne 1 ) ) {  
            $ErrorOut = $result.content | write-2PintConsole  
        } 
        else { 
            $restOut = $result.Content 
        } 
    } 
    catch { 
        write-warning "Failed to make Web Request to https://internal8021xapi" 
        $ErrorOut = $_ | write-2PintConsole  
    } 

    #Now output to Console: 
    if ( $ErrorOut ) { 

         @" 

echo #################################################### 
echo #################################################### 
echo 
echo Failure to get MAB 802.1x exception: 
echo 
$( $ErrorOut -join [environment]::newline ) 
echo 
echo #################################################### 
echo #################################################### 
prompt --key q Press 'q' to quit && exit || echo continue 

"@  | Write-Output 
    } 
    else {  
    
        @" 

set currentnic `${netX/ifname} 

echo %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 
echo Start MAB Exception process [`${currentnic}] ... 
ifstat `${currentnic} 
echo %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 

#ping -c 1 sccmipx2.corp.contoso.com && goto mabdone || echo Unable to ping sccmipx2 
#ping -c 1 sccmipx1.corp.contoso.com && goto mabdone || echo Unable to ping sccmipx1 

echo Unable to reach SCCMIPX[1|2] Begin Mab Process  `${currentnic} 

ifclose `${currentnic} 

echo sleep 10 and restart NIC `${currentnic} 
sleep 10 

:mabretry 
ifconf `${currentnic} || goto mabbadnic 
iflinkwait --timeout 1000 `${currentnic} || goto mabbadnic 

#ping -c 1 sccmipx2.corp.contoso.com && goto mabdone || echo Unable to ping sccmipx2 
#ping -c 1 sccmipx1.corp.contoso.com && goto mabdone || echo Unable to ping sccmipx1 

ping -c 1 ipxe.corp.contoso.com && goto mabnobypass || goto mabbadnic 

:mabbadnic 
echo %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 
echo %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 
echo 
echo Unable to reach ipxe.corp.contoso.com. NIC in a bad state. 
echo  
echo If this is the first time seeing this error, press ENTER for reset. 
echo If the problem persists, shutdown the machine and retry. 
echo If the problem STILL persists, take a picture of this screen and escalate. 
echo 
echo %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 
echo %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 
ifstat `${currentnic} 
prompt --timeout 30000 press return to retry reset 
ifclose `${currentnic} 
goto mabretry 

:mabnobypass 
echo %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 
echo %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 
echo 
echo Unable to reach 802.1x protected machine(s). 
echo  
echo If this is the first time seeing this error, press ENTER for reset. 
echo If the problem persists, try disconnecting the network cable and retry. 
echo If the problem persists, shutdown the machine and retry. 
echo If the problem STILL persists, take a picture of this screen and escalate. 
echo 
echo %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 
echo %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 
ifstat `${currentnic} 
prompt --timeout 30000 press return to retry reset 
# ifclose `${currentnic} 
set completeurl `${pxeurl}2PXE/boot##params=paramdata 
echo Boot... `${pxeurl}2PXE/boot##params=paramdata 
chain --autofree --replace `${pxeurl}2PXE/boot##params=paramdata || goto mabretry 

:mabdone 
echo %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 
echo Finish Network Reset for 802.1x `${currentnic} 
echo MAB DONE! 
echo %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 

prompt --timeout 30000 press return to FINISH 

"@ | write-output 

    } 

} 
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://documentation.2pintsoftware.com/2pxe-server/4.0/configuration/ipxe-802.1x-integration.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.