Header Only - DO NOT REMOVE - Extreme Networks
Solved

Guidance in securing IP Phones and cameras with Extreme Control EAP-TLS

  • 6 August 2019
  • 4 replies
  • 362 views

I am deploying Extreme Control and have the user authenticating fine. I am looking to secure other devices such as phones and cameras. From what I have seen, an Active Directory object is created for each of these devices in order for authentication to be successful. Is this the case? Is there a better way to do it that does not involve me adding 1000s of AD user objects? These devices already have certs issued to them.

Any guidance is appreciated.

Thanks.
icon

Best answer by Ryan Yacobucci 6 August 2019, 19:25

Hello,

An active directory object is not required for successful authentication when using EAP-TLS authentication.

When using EAP-TLS you set NAC to "Local Authentication" and install necessary RADIUS certificates and Trusted Authority certificates on the NAC itself.

NAC will provide it's RADIUS certificate to the client for validation, then the client will send it's certificate to the NAC for validation. As long as the AAA trusted authority certificate installed is the same certificate that signed the client certificate authentication will be successful.

There is no computer or user account necessary as EAP-TLS is not password based authentication.

The problem that you will run into is that without any AD objects it may become difficult to put these into authorization roles as since there are no AD objects we cannot utilize and AD technologies like security containters. LDAP lookups will not work if there are no objects in AD.

We can still use the CN of the certificate to provide an authorization though.

Thanks
-Ryan
View original

4 replies

Userlevel 1
I would create a rule for voip to prioritize traffic and put it on its own vlan. Phones really should be on their own vlan, and work well with Control to do that on the fly. I'm not sure why you'd want to go through all that effort. I would just put that traffic on its own vlan with its own authentication rules.
Userlevel 6
Hello,

An active directory object is not required for successful authentication when using EAP-TLS authentication.

When using EAP-TLS you set NAC to "Local Authentication" and install necessary RADIUS certificates and Trusted Authority certificates on the NAC itself.

NAC will provide it's RADIUS certificate to the client for validation, then the client will send it's certificate to the NAC for validation. As long as the AAA trusted authority certificate installed is the same certificate that signed the client certificate authentication will be successful.

There is no computer or user account necessary as EAP-TLS is not password based authentication.

The problem that you will run into is that without any AD objects it may become difficult to put these into authorization roles as since there are no AD objects we cannot utilize and AD technologies like security containters. LDAP lookups will not work if there are no objects in AD.

We can still use the CN of the certificate to provide an authorization though.

Thanks
-Ryan
Hello,

An active directory object is not required for successful authentication when using EAP-TLS authentication.

When using EAP-TLS you set NAC to "Local Authentication" and install necessary RADIUS certificates and Trusted Authority certificates on the NAC itself.

NAC will provide it's RADIUS certificate to the client for validation, then the client will send it's certificate to the NAC for validation. As long as the AAA trusted authority certificate installed is the same certificate that signed the client certificate authentication will be successful.

There is no computer or user account necessary as EAP-TLS is not password based authentication.

The problem that you will run into is that without any AD objects it may become difficult to put these into authorization roles as since there are no AD objects we cannot utilize and AD technologies like security containters. LDAP lookups will not work if there are no objects in AD.

We can still use the CN of the certificate to provide an authorization though.

Thanks
-Ryan

Thanks for the quick reply Ryan. This is what I am looking for and will start testing soon.
Seems like Avaya phones want to use the MAC for username / password to authenticate the phone. I was not able to go based on the CN alone. Could be a limitation of the Avaya 9600s phones. Has anyone experienced this before?

Reply