Header Only - DO NOT REMOVE - Extreme Networks

NAC RADIUS attributes for C35 controller running 10.01.04.0011


Userlevel 1
We are in the process of migrating from WC4110 controllers to C35 controllers. We use NAC to authenticate the users against AD. This works perfectly on the older controllers. However, not working so well on the new controllers. Apparently there is a minor change needed to get the authentication working correctly.

For the WC4110, we have them set up in a NAC appliance group:

Switch type: Layer 2 O-O-B
Primary gateway:
Secondary gateway: none
Auth Access Type: Network Access
Gateway RADIUS Attributes to Send: Extreme IndentiFi Wireless



The rule is set as follows:
Authentication method: 802.1x
User group: LDAP-USERS
End-system group: Any
Device Type Group: Any
Location group: ENTERPRISE (this is the name of the VNS on the controller)
Time group: Any
Profile: ENTERPRISE_BYOD
Portal: Default



This works perfectly with our old controller. The users authenticate via 802.1x, LDAP lookup works, they come back and hit the right rule on the NAC and the correct role is returned to the controller.

However, with this same setup in the NAC for the C35, it does not correctly identify the location group and the rule fails, thus returning the default profile rather than ENTERPRISE_BYOD which is what we want.

I believe this is related to how the C35 switch entry is defined on the NAC. I believe the C35 must need a different setup for the Auth Access Type and Gateway RADIUS Attributes to Send fields than how it is defined for the WC4110.

I realize that's somewhat confusing so if you need more info please ask.

14 replies

Userlevel 7
Hi Scott,

you'd check why a rule doesn't hit.

Right click on the client and select "configuration evaluation tool" and then in the next window click on "run evalution" - click on the rule for details - could you please post the output so we'd take a look.

-Ron



Userlevel 7
Ron wrote:

Hi Scott,

you'd check why a rule doesn't hit.

Right click on the client and select "configuration evaluation tool" and then in the next window click on "run evalution" - click on the rule for details - could you please post the output so we'd take a look.

-Ron





Sorry I've missed the info that the rule fails because of the location group so just ignore the above post.
Userlevel 7
Could you please post a screenshot of the location group settings.
Userlevel 1
Ron wrote:

Could you please post a screenshot of the location group settings.

Sure thing. There are 4 switch entries here. My two old controllers .10 and .11, and my new C35's .14 and .15. This rule works as intended with .10 and 11 but does not trigger with .14 and 15 and so the users are authenticated against our default-catchall rule rather than this one as they should be.

Userlevel 7
Ron wrote:

Could you please post a screenshot of the location group settings.

Just a wild guess.... could it be that you've the admin port of the controller connected to the network and the controller is sending the RADIUS requests via that port = isn't using the 10.140.20.x address and the rule doesn't match
Userlevel 7
Ron wrote:

Could you please post a screenshot of the location group settings.

So here a example if you run the evalution tool (description above) and the rule fails because of a missmatch in the location group = request from the wrong IP.

In the top section you'd see the source information of the request.
Could you check/post that so we'd make sure that the request is coming from .14/.15 with the correct parameters.

Userlevel 3
Scott,

Can you double-check the RADIUS set up on your C35 and post a screenshot? There was a bug in v10 of the wireless firmware so when adding a controller, the RADIUS server info was corrupted. Just want to make sure that did not bite you.
Userlevel 1
Bill Handler wrote:

Scott,

Can you double-check the RADIUS set up on your C35 and post a screenshot? There was a bug in v10 of the wireless firmware so when adding a controller, the RADIUS server info was corrupted. Just want to make sure that did not bite you.

Sure, here you go. Radius from the old controller:



And radius from the new controller:

Userlevel 1
The config evaluation tool kind of tells me what I was already starting to think. That the data being passed back from the new controller isn't the same as what's being passed back from the old controller.

Here is where the NAC says I am failing the rule:

PASSED: The Device Type of: MAC Address: AC:37:43:4A:B2:79, IP Address: 10.147.16.52, Host Name: android-ef3622142e1ba508 passes the any criteria evaluation.

PASSED: The User: svanarts has LDAP attributes that match the ones defined in LDAP User Group: SJGH-LDAP-USERS.

FAILED: The Switch IP of: 10.140.20.14, Port: SJGH-ENTERPRISE, SSID: null, AP Name: null, AP MAC: null, AP Serial: null and AP Zone or Group: null and AP Location: null did not match this inclusive criteria.

Compare that with the old controller where I am passing the rule:

PASSED: The User: svanarts has LDAP attributes that match the ones defined in LDAP User Group: SJGH-LDAP-USERS.

PASSED: The Switch IP of 10.140.20.10, SSID: SJGH, AP Name: AP-272 MedStaff-Copy-Room-113, AP MAC: 20-B3-99-B6-7F-29, AP Serial: 13411855595D0000 and AP Zone or Group: null and AP Location: null did match this inclusive criteria.

PASSED: The Time of: Monday, October 31, 2016 8:55:47 AM PDT passes the any criteria evaluation.
PASSED: The Operating System Name of: passes the any criteria evaluation.

So on the new controller I am not seeing the SSID or AP Name being passed back from the controller to the NAC.
Userlevel 7
Give me a sec I think I know what is going wrong - need to fire up my controller.
Userlevel 7
OK, in the controller on the Wirless Services click on the NAC that you've selected (NAC1 in my case - the field changes to gray) and then you'd click on RADIUS TLVs to configure which additional information the controller should send in the RADIUS request.
Normaly I choose VNS Name, AP Name, SSID but you'd check what is set on the 4110 pair.

Here my example...

Userlevel 7
just to make sure... the SSID on the C35 is named "SJGH" and not "SJGH-ENTERPRISE" because the location is set to "SJGH" as far as I'd see it from the screenshot.
Userlevel 1
Bingo! That was it. The RADIUS TLVs. Thank you very much!
Userlevel 7
Great, I'm glad I was able to help.

Reply