Solved

Extreme Control Rule and AD

  • 29 September 2020
  • 31 replies
  • 241 views

Userlevel 2

Hi All,

 

I am trying to create Extreme Control rule sets for MAC and .1x authentication.

Is there not a way I can add a group condition to query a LDAP/AD Domain group?

I can see there is an option for LDAP user groups.

 

Also, do Extreme offer some sort of downloadable config for updating DHCP fingerprints.

Its really tedious to have to go in and add lines of code to add custom fingerprints, not to mention having to hunt through a log file to get them in the first place.

 

One other thing, any ideas/thoughts on being able to add if/or conditions into the same rule?

Thanks

Ian

icon

Best answer by Miguel-Angel RODRIGUEZ-GARCIA 13 October 2020, 10:53

Stefan,

 

With a script from @Zdenek Pala (https://github.com/extremenetworks/ExtremeScripting/blob/master/Netsight/oneview_workflows/combo/UserAndComputer/Clear_old_End-Systems_in_the_group-8.3.1.9v5.xwf?raw=true) you can mix both authentications to ensure that the user authentication is done on a computer from the domain:

"Add MAC to Domain Computers" is executed when the computer authenticates. The MAC address is added to End-System and the timestamp is created (updated). Consequent User authentication can be combined with the condition of the End-System group. "Clear old End-Systems in the group" checks if the timestamp is older than X hours and old End-Systems are deleted from the group.

 

Mig

View original

31 replies

Userlevel 2

ok, just read 8.5 release notes, alot more functionality for DHCP fingerprinting.

other concerns still stand though if anyone has any thoughts please.

Userlevel 6
Badge +1

Ian,

 

  1. Yes you can create a condition to trigger a rule based on an LDAP group
    1. https://gtacknowledge.extremenetworks.com/articles/How_To/How-To-Match-NAC-LDAP-Lookup-To-Active-Directory-Windows-Security-Group
    2. https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-authorise-Windows-domain-user-computer-using-802-1x-and-LDAP-lookups-to-ensure-the-user-AND-computer-is-in-the-domain-denying-access-to-users-with-valid-domain-credentials-on-BYOD-devices
    3. an others articles
  2. I don’t know for the DHCP fingerprint tool
  3. You can add if/or at different levels
    1. In the group definition
      1. in the policy mappings (a Location Group lookup will trigger the return values)

Regards

 

Mig

 

Userlevel 4

Is there not a way I can add a group condition to query a LDAP/AD Domain group?

I can see there is an option for LDAP user groups.

Hi Ian,

of course there is! :)

This user group is used in a NAC-Rule to allow the CLI-Access to network switches for the configured AD-Group (which is censored in the screen).

Can of course also used in combination with MAC and Dot1x Auth.

Edit: Dang, much too slow.

Userlevel 2

are you able to use an attribute that isnt returned by the device used for testing the connection?

 

I picked my host for example of which I know what domain groups it belongs to.

 

is it just a memberof attribute you can use? or can you use something else?

 

I tried to reference a rule with a memberof attribute and tested on a specific client to which i took the value knowing that client is in that AD group and then specifically tried to get that client to match but it never did. 

 

Userlevel 6
Badge +1

Ian,

You can use any attribute refering the object in the AD.

Your missed test is probably a syntax isue.

Here an example for the memberOf attribute

 

If you want to use another attribute, just change the name of the attribute

Mig

 

Userlevel 2

we have a group for Domain computers, when I browse AD i can see my host is a member of 3 groups, one being Domain Computers.

 

I want to use this group to reference as a memberOf attribute in the LDAP host group and then use this as a condition in the rule.

 

when I test my host it only reports back the other two groups under the memberOf attribute.

 

I’ve asked my AD guys if they can think of why it doesn't report the Domain Computers back as a value, see below;

 

 

doesnt report the Domain Computers value. They’re all security groups.

 

I’m told the account used in the LDAP config has read access to the Domain, perhaps this is not enough?

Userlevel 6
Badge +1

Indeed: https://gtacknowledge.extremenetworks.com/articles/Q_A/Active-Directory-Permissions-For-NAC-NTLM-Authentication/

Mig

we have a group for Domain computers, when I browse AD i can see my host is a member of 3 groups, one being Domain Computers.

 

I want to use this group to reference as a memberOf attribute in the LDAP host group and then use this as a condition in the rule.

 

when I test my host it only reports back the other two groups under the memberOf attribute.

 

I’ve asked my AD guys if they can think of why it doesn't report the Domain Computers back as a value, see below;

 

 

doesnt report the Domain Computers value. They’re all security groups.

 

I’m told the account used in the LDAP config has read access to the Domain, perhaps this is not enough?

Indeed: https://gtacknowledge.extremenetworks.com/articles/Q_A/Active-Directory-Permissions-For-NAC-NTLM-Authentication/

Mig

Userlevel 6
Badge +1

Ian,

You need to adapt the user rights with this: https://gtacknowledge.extremenetworks.com/articles/Q_A/Active-Directory-Permissions-For-NAC-NTLM-Authentication/

Mig

Userlevel 2

Thank you, i’ll ask the AD guys to check the account permissions for the account used for the LDAP config.

Userlevel 7

Hi,

for some rule components you have “OR” and “AND” already:

 

regarding the DHCP fingerprinting, here is a new GitHub repository. Feel free to contribute :)

 

Userlevel 3
Badge

I think the problem of Ian ist, that Extreme Control does not support checking ldap attributes of nested group memberships.

You can only check ldap attributes where the account is direct assigned

Userlevel 7

I think the problem of Ian ist, that Extreme Control does not support checking ldap attributes of nested group memberships.

You can only check ldap attributes where the account is direct assigned

If Nested Groups are used then you need to add each nested group to the list and use mode “Match Any”. I saw a customer automated this task through API calls.

Userlevel 3
Badge

I think the problem of Ian ist, that Extreme Control does not support checking ldap attributes of nested group memberships.

You can only check ldap attributes where the account is direct assigned

If Nested Groups are used then you need to add each nested group to the list and use mode “Match Any”. I saw a customer automated this task through API calls.

Of course, but this is only a dirty workaround and not a solution. I hope Extreme will support this in the future.

Userlevel 2

Its not a nested group actually but if im honest anything that makes the integration better is a win for sure, its a global security group that sits in an OU along with other security groups. It does not belong to other groups.

Its the group all domain joined PCs/Laptops become a member of when joined to the domain.

the other groups i referenced above are also part of the same OU yet the host only reports the memberOf attributes of the other two groups, not the domain computers one. 

Still waiting on the permissions check with the account used in the LDAP config.

 

Will let you know if this solves it.

Userlevel 2

Yep looks like it could well be an account issue as getting this error on the Appliance

2020-10-01 15:58:41,919 ERROR [com.enterasys.tesNb.server.freeradius.files.SambaInstallationManager] (EnforceHandler - Off Thread Notify Listeners0:) Failed to join domain: "removed" for user: "removed" with error code: 255
        ADS join did not work, falling back to RPC...
        Failed to join domain: User specified does not have administrator privileges
        Failed to join domain: failed to find DC for domain “removed” - {Operation Failed} The requested operation was unsuccessful.
 

Userlevel 2

So is there a way you can make the conditions in a rule be or conditions?

At the moment any conditions in the rule all have to be matched?

For example I have a rule for Medical devices. I would like it so that if Fingerprinting determines its  “medical device” it will hit this rule or if its part of a certain vlan/subnet to which I know for a fact is solely for medical devices

 

or do i have to have multiple rules to be able to capture this behaviour?

Userlevel 6
Badge +1

Ian,

 

A workaround could be to define a new devicegroup including all the fingerprints you are looking for and match this group.

Mig

Userlevel 2

thats fine but the issue is the manual process of adding fingerprints.

some things on the Medical subnet might not be classed as a medical device based on the default fingerprints, hence the reason to reference the multiple conditions in a rule.

 

would be ideal if the invert option was alongside an or and an and statement.

Userlevel 2

ok, so back on topic, as a test, the account used to join the EAC appliances to the domain/used in the ldap configuration was given full domain admin rights. 

 

When testing it still couldnt see the host device return the memberof attribute for the “domain computers” group. it worked for all other member groups as mentioned in an earlier host.

 

any ideas?

Userlevel 6
Badge +1

Ian,

 

Do you test with the test button on the LDAP config screen?

Could you share your config with a screen shot?

Mig

Userlevel 2

Yep using the test function, what config do you want to see?

Userlevel 6
Badge +1

The LDAP config you use for the host

Userlevel 2

 

Userlevel 6
Badge +1

Ian

 

There is a way to configure the NAC for host authentication that doesn’t seems obvious but needs to be followed.

You must create an LDAP connection for user authentication and one for computer authentication.

For the computer authentication (almost copy of the user one) you must use “servicePrincipalName” as “user search attribute”  because the computer is in fact doing a “user authentication” with his own credentials.

You’ll have to adapt you AAA authentication rules to send computer authentications (host/*.ldap.domain)to the “computers ldap”

 

Check this for the config and let me know:

https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-authorise-Windows-domain-user-computer-using-802-1x-and-LDAP-lookups-to-ensure-the-user-AND-computer-is-in-the-domain-denying-access-to-users-with-valid-domain-credentials-on-BYOD-devices/

Mig

Userlevel 4

Hi guys,

just a short question on this topic. When using 802.1x computer authentication the user coloumn in ExtremeControl is populated with host\computername.domain.tld

Is there any way to additionally check for the user that is logged on the computer? I want to use the client certificate to authenticate and the user to authorise based on the users AD Groups.

BR
Stefan

Reply