Solved

Can't select user groups in authentication mapping

  • 8 August 2019
  • 7 replies
  • 341 views

Userlevel 4
In the EAC you can configure the authentication rules in the AAA section. in one of those rules (Management Login) I want to configure an user group .

According to the help file ,should this be possible.

User/MAC/Host
Select the Pattern radio button and enter the username, MAC address, or hostname that the end-system must match for this mapping. Or, select the Group radio button and select a user group or end-system group from the drop-down list. If you enter a MAC address, you can use a colon (:) or a dash (-) as an address delimiter, but not a period (.).

The only groups I can select are End-System Groups.

How can I select an user groups ?



icon

Best answer by Ryan Yacobucci 21 August 2019, 14:31

The switch might be allowing you in just because the Access was "Accept". Can you change the "Denied Access NAC profile" and set it to "Reject authentication requests".

It will be the option at the top of the profile.

Thanks
-Ryan
View original

7 replies

Userlevel 4
Extra information: I cann't select LDAP user groups that are created.
Userlevel 6
Hello Johan,

LDAP usergroups can only be used in the AAA with authentication type "Registration (Auth&Admin)".

Are you looking to send management authentications to a different authentication server based on LDAP group membership, or prevent access based on group membership?

If you're looking to prevent access based on LDAP membership the way you would do that is create a rule in the rules engine with LDAP usergroup that had an accept with appropriate management access AVPs, and below this rule create another rule for all management requests to would deny.

That way unless you're part of the LDAP group configured in the first rule you'll fall into a deny role.

Let me know if this is what you're looking for.

Thanks
-Ryan
Userlevel 4
I've made roles and tested a connection to a swtich and a connection to an EWC controller.

Both systems have the same EAC controlers.

When connecting to the EWC with wrong credentials , the connection is refused.
When I do the test to a switch I can loging and have user rights.

Did I forgot something?
Userlevel 6
I"d have to take a look at the configuration.

If you look at the Alarms & Events --> Events --> Type of "NAC" or "Access Control Engine".

When you login to the switch and the controller take a look at those events. Did they hit the same rule?

Does the rule they hit indicate they were returned a "reject"?

Thanks
-Ryan
Userlevel 4
Results
Management login to switch 10.2.112.211. No Access granted for User: x326000, due to NAC Filter-Id: Enterasys:version=1:policy=Deny Access, Profile: Registration Denied Access NAC Profile Authentication Protocol: PAP, Request Attributes - Service-Type: 1, User-Name: x326000, Calling-Station-Id: 00-00-00-00-00-00, NAS-IP-Address: 10.2.112.211, OPENFLOW_DATAPATH_ID: 19706979330, NAS-Identifier: SW-A11, Called-Station-Id: 00-04-96-A0-A4-02, NAS-Port-Type: 5, NAS-Port: 0, Source-Address: 10.2.112.211 - Response Attributes - Filter-Id: Enterasys:version=1:policy=Deny Access - This is an administrative request because the MAC is zeros: 00-00-00-00-00-00, username is not null and no EAP-Message, MS-CHAP-Challenge or Tunnel-Client-Endpoint is present.

Management login to wireless controller 10.2.112.3. No Access granted for User: x326000, due to NAC Service-Type: null, Profile: Registration Denied Access NAC Profile Authentication Protocol: PAP, Request Attributes - Service-Type: 7, User-Name: x326000, NAS-IP-Address: 10.2.114.1, NAS-Identifier: EWC, NAS-Port-Type: 5, NAS-Port: 0, Source-Address: 10.2.112.3 - Response Attributes - Filter-Id: Enterasys:version=1:policy=Deny Access, Login-LAT-Port: 0 - This is an administrative request because the MAC is null, username is not null and no EAP-Message, MS-CHAP-Challenge or Tunnel-Client-Endpoint is present.
Userlevel 6
The switch might be allowing you in just because the Access was "Accept". Can you change the "Denied Access NAC profile" and set it to "Reject authentication requests".

It will be the option at the top of the profile.

Thanks
-Ryan
Userlevel 4
Ryan, this works. Thanks for the solution

Reply