Currently in the process of configuring Palo Alto to authenticate with ExtremeControl via RADIUS authentication.
Have everything in place, have configured the respective custom attributes to send Palo Alto once authentication has passed.
At this time ExtremeControl is continually returning a reject due to Missing Attributes!?
Everything else configuration seems to be working as it should, by this last issue.
Here is a snapshot of the logs showing the issue:
Got ES authorization result: Rule: "Palo Alto Management Login" with profile: Administrator NAC Profile
Switch: 172.20.255.111 requires the port (ReqStdAttrs: true, ForIpRes: false, ForReauth: true, DoesPostAuthDisc: false)
rejecting request because: RADIUS client not standards-compliant. Missing attributes: End-System MAC Address, NAS Port
The issue seems to be the missing End-System MAC address and / or NAS Port?
From what I can tell there doesn't seem to be any means within Palo Alto to add these VSA's to pass back to ExtremeControl?
Have looked into this GTAC entry that mentions requiring the Calling-Station-ID:
The only VSA's that I can find with are configurable on the Palo Alto to send are as follows, but seem client related only:
set authentication radius-vsa-on client-source-ip
set authentication radius-vsa-on client-os
set authentication radius-vsa-on client-hostname
set authentication radius-vsa-on user-domain
set authentication radius-vsa-on client-gp-version
This is what I've configured in ExtremeControl to return to Palo Alto on a successful access accept, so my hope is once past this last hurdle all should work:
XMC / Control = 188.8.131.52
Palo Alto = 8.1.5
Thanks in advance