topic Re: User Profile Client Classification/Assigment in Aerohive Migrated Content

User Profile Client Classification/Assigment

AnonymousM — Mon, 02 Sep 2019 09:35:05 GMT

A customer has a client classification in their default untrusted user profile which moves the client to the trusted VLAN based on domain name string (wildcard).

This essentially allows their 802.1x Corp SSID to be used for both domain corp laptops and staff BYOD.

Is this possible in NG under User Profile Assignment?

I have not seen this done, normally have offered one 802.1x ssid for Corp and another 802.1x ssid for BYOD to allow staff to join using AD credentials.

This image shows the config in Classic for the Domain Client Classification object:

Re: User Profile Client Classification/Assigment

samantha_lynn — Mon, 02 Sep 2019 17:16:39 GMT

We are able to use client classification in HiveManager. This guide reviews how to set this up: https://thehivecommunity.aerohive.com/s/article/Client-Classification-in-HiveManager

Re: User Profile Client Classification/Assigment

AnonymousM — Mon, 02 Sep 2019 18:33:20 GMT

Thanks Sam, unfortunately I get a page error following that link. I have tried on multiple browsers. (https://thehivecommunity.aerohive.com/s/article/Client-Classification-in-HiveManager)

Are you able to send a PDF if the link is not available.

Re: User Profile Client Classification/Assigment

samantha_lynn — Mon, 02 Sep 2019 19:29:25 GMT

I'm sorry for the trouble viewing that guide, were you logged in to Hive Community at the time? I've emailed you a copy now, please don't hesitate to let me know if you have issues with that file.

Re: User Profile Client Classification/Assigment

AnonymousM — Tue, 03 Sep 2019 01:15:13 GMT

Hi, thanks for the file. yep I was logged in for the URL.

It appears it is no longer possible in NG to select/classify clients based on their laptop Domain Name, like in Classic.

The options are limited to OS, MAC, location and Schedule.

I will see if the customer is happy to use a second SSID for this now.

Thanks

Re: User Profile Client Classification/Assigment

ashley_finch — Tue, 03 Sep 2019 16:05:05 GMT

The link isn't working for me either.

Instead of the above, could you enable "Allow user profiles assignment using RADIUS attributes" and then return a specific attribute that would then place the user in a particular user profile?

You mentioned that they're using domain names to separate this at the moment, are these part of the username e.g. user1@example.com? Then you may be able to use the 1_User-name attribute and return the example.com for a particular profile, then a different one for the others. I guess setup may not reflect that and it's not something I've set up in that way before, but trying to think outside the box!

Re: User Profile Client Classification/Assigment

AnonymousM — Tue, 03 Sep 2019 17:32:36 GMT

Thanks Ashley, that sounds a good plan. The domain hostname is used to distinguish a machine certificate based corp laptop, from a BYOD device which is authenticated using AD credentials. Places the device in either the trusted or untrusted default user profile.

Just to confirm there is only a single domain - the multiple lines were different wildcard variations.

Is there a RADIUS Attribute that can be used to classify whether the machine certificate is not returned or returned. If not returned then classifies client as BYOD, but if certificate passes, then classified as corp client machine.

Re: User Profile Client Classification/Assigment

mmarengo — Wed, 11 Mar 2020 00:45:20 GMT

I am running into a similar scenario. I am trying to use Classification Rules using Domain Objects to push clients to a different User Profile but I have not got much luck unless I leave all the options to any-any

Here is my set up.

The SSID is using Radius
The Radius Server MS NPS forwards the connection request to an external Radius Server "ANYROAM"
Clients get authenticated and put on the default vlan 100
Using Classification Rules, Aerohive HM Classic pushes all clients to vlan 425

The goal will be to NOT push all clients to vlan 425, only the ones coming from certain domain name.

Whenever I try to configure a domain object with the domain example.edu, it looks to be ignored by aerohive and users are put on the default vlan.

I am not able to use NPS to send any attributes or a network policy because the request for this connection is forwarded to an external Radius Server

Any ideas suggestions will be much appreciate it.

Thank you,