topic Re: I've configured for BOYD and set the time out to 7 days. As a test I've signed onto the BOYD and it works, but I then changed my password and the connection continues to work. We would like the AP to re-authenticate when someones credentials change? in Aerohive Migrated Content

I've configured for BOYD and set the time out to 7 days. As a test I've signed onto the BOYD and it works, but I then changed my password and the connection continues to work. We would like the AP to re-authenticate when someones credentials change?

AnonymousM — Fri, 01 Mar 2019 22:26:20 GMT

We eventually want the BOYD to not expire at all. We have a 60 day password policy which is the only time we're expecting the user to need to sign into the connection again.?

Re: I've configured for BOYD and set the time out to 7 days. As a test I've signed onto the BOYD and it works, but I then changed my password and the connection continues to work. We would like the AP to re-authenticate when someones credentials change?

AnonymousM — Sat, 02 Mar 2019 02:32:49 GMT

Are you using a self registration method for the BYOD users?

Are there multiple Users in the BYOD User Group?

Is the User Group Local or Cloud?

Are you pushing any updates when you adjust the credentials of a User?

Re: I've configured for BOYD and set the time out to 7 days. As a test I've signed onto the BOYD and it works, but I then changed my password and the connection continues to work. We would like the AP to re-authenticate when someones credentials change?

AnonymousM — Mon, 04 Mar 2019 00:29:12 GMT

Hi Stephen,

Thanks for getting back to me. To answer your questions:

We’ve linked BYOD to Radius so users are authenticating against our AD.
We haven’t limited it to a BYOD user group although at the moment I’m only testing with my account.
It’s an on prem radius server so local (although I didn’t set that bit up so I can’t be 100% certain).
I don’t understand the last question so I suspect no we’re not pushing any updates. How would I determine that for certain?

Thanks again.
Regards,
Mike

Mike Twist
IT Site Manager
Cash Processing Solutions
Mike.Twist@cps.world
+44 1256 373773
+44 7393 253473
www.cps.world

************************************************************ This e-mail is sent on behalf of Cash Processing Solutions Limited.
The e-mail and any attached files are strictly confidential and are intended solely for the attention of the addressee.
If you have received this email in error, please notify the sender and then delete the e-mail and any attachments.
Where the content of this email is personal or otherwise unconnected with Cash Processing Solutions Limited or its customers' business, Cash Processing Solutions Limited accepts no responsibility or liability for such content.
You are advised to ensure that you have adequate virus protection as Cash Processing Solutions Limited does not accept liability for any viruses.
Cash Processing Solutions Limited (company No.10069434) is registered in England with their registered office at: Matrix House, Basing View, Basingstoke, Hampshire RG21 4DZ.
************************************************************
#_Single_Disclaimer_1.0

Re: I've configured for BOYD and set the time out to 7 days. As a test I've signed onto the BOYD and it works, but I then changed my password and the connection continues to work. We would like the AP to re-authenticate when someones credentials change?

AnonymousM — Mon, 04 Mar 2019 22:10:39 GMT

You may benefit from COA - RFC 3576. Under the optional settings of your AAA client settings you can enable it. Look for the "Permit Dynamic Change of Authorization Messages (RFC 3576)" checkbox.

Re: I've configured for BOYD and set the time out to 7 days. As a test I've signed onto the BOYD and it works, but I then changed my password and the connection continues to work. We would like the AP to re-authenticate when someones credentials change?

AnonymousM — Tue, 05 Mar 2019 00:17:47 GMT

Hi Brian,

Thanks for your info. I’m struggling to find the AAA client settings. I can find the AAA server settings (configure>common objects>authentication) but we don’t have anything listed there.

Regards,
Mike

Mike Twist
IT Site Manager

Re: I've configured for BOYD and set the time out to 7 days. As a test I've signed onto the BOYD and it works, but I then changed my password and the connection continues to work. We would like the AP to re-authenticate when someones credentials change?

AnonymousM — Tue, 05 Mar 2019 00:22:31 GMT

It's your radius configuration. You can simply edit from your Network Policy too.

If HM Classic though, it's under Advanced Configuration -> Authentication -> AAA Client Settings.

HM NG Common Objects -> Authentication -> AAA Server Settings.

Re: I've configured for BOYD and set the time out to 7 days. As a test I've signed onto the BOYD and it works, but I then changed my password and the connection continues to work. We would like the AP to re-authenticate when someones credentials change?

AnonymousM — Tue, 05 Mar 2019 00:25:42 GMT

I’ve found the right place then, but it’s empty. There are “no records found”?
The radius server in our configuration is on-prem and not Aerohive. Would that make a difference?

Mike Twist
IT Site Manager
Cash Processing Solutions
Mike.Twist@cps.world
+44 1256 373773
+44 7393 253473
www.cps.world

************************************************************ This e-mail is sent on behalf of Cash Processing Solutions Limited.
The e-mail and any attached files are strictly confidential and are intended solely for the attention of the addressee.
If you have received this email in error, please notify the sender and then delete the e-mail and any attachments.
Where the content of this email is personal or otherwise unconnected with Cash Processing Solutions Limited or its customers' business, Cash Processing Solutions Limited accepts no responsibility or liability for such content.
You are advised to ensure that you have adequate virus protection as Cash Processing Solutions Limited does not accept liability for any viruses.
Cash Processing Solutions Limited (company No.10069434) is registered in England with their registered office at: Matrix House, Basing View, Basingstoke, Hampshire RG21 4DZ.
************************************************************
#_Single_Disclaimer_1.0

Re: I've configured for BOYD and set the time out to 7 days. As a test I've signed onto the BOYD and it works, but I then changed my password and the connection continues to work. We would like the AP to re-authenticate when someones credentials change?

AnonymousM — Tue, 05 Mar 2019 00:28:31 GMT

Sorry, i'm not very fluent with HM NG.

So you had to tell the APs where to point the .1X auth attempts. It may have been moved to External RADIUS Servers.

Re: I've configured for BOYD and set the time out to 7 days. As a test I've signed onto the BOYD and it works, but I then changed my password and the connection continues to work. We would like the AP to re-authenticate when someones credentials change?

AnonymousM — Tue, 05 Mar 2019 00:31:14 GMT

I’ve taken a look at the radius server configuration and there doesn’t appear to be a CoA option there. Looks like it might not work that way for an External Radius server.

Mike Twist
IT Site Manager

Re: I've configured for BOYD and set the time out to 7 days. As a test I've signed onto the BOYD and it works, but I then changed my password and the connection continues to work. We would like the AP to re-authenticate when someones credentials change?

AnonymousM — Tue, 05 Mar 2019 00:37:34 GMT

So you're looking in the right spot I think. But that feature/functionality may not be in HMNG yet. @Sam Pirok (Aerohive) can you confirm that enabling COA for RADIUS servers is not yet in HMNG?

I jumped into a customer HMNG account and did not see the optional settings section at all either.

Re: I've configured for BOYD and set the time out to 7 days. As a test I've signed onto the BOYD and it works, but I then changed my password and the connection continues to work. We would like the AP to re-authenticate when someones credentials change?

ashley_finch — Tue, 05 Mar 2019 00:46:24 GMT

Is this what you're looking for?:

SSID > Scroll to Authentication Setting Section > clikc the RADIUS Server group > Cog next to RADIUS Server Group Description

Re: I've configured for BOYD and set the time out to 7 days. As a test I've signed onto the BOYD and it works, but I then changed my password and the connection continues to work. We would like the AP to re-authenticate when someones credentials change?

AnonymousM — Tue, 05 Mar 2019 00:52:50 GMT

Yes! That's it. Thanks. Hopefully that'll help @Mike Twist .

Re: I've configured for BOYD and set the time out to 7 days. As a test I've signed onto the BOYD and it works, but I then changed my password and the connection continues to work. We would like the AP to re-authenticate when someones credentials change?

AnonymousM — Tue, 05 Mar 2019 21:50:32 GMT

Hi Brian,

Thanks for all your help with this. Sadly one of the licences expired and now HiveManager won’t let me do anything until we sort it out so I can’t confirm the solution but you and Ashley seem confident. Hopefully I can get this resolved… eventually.

Thanks again guys,
Mike

Mike Twist
IT Site Manager
Cash Processing Solutions
Mike.Twist@cps.world
+44 1256 373773
+44 7393 253473
www.cps.world

************************************************************ This e-mail is sent on behalf of Cash Processing Solutions Limited.
The e-mail and any attached files are strictly confidential and are intended solely for the attention of the addressee.
If you have received this email in error, please notify the sender and then delete the e-mail and any attachments.
Where the content of this email is personal or otherwise unconnected with Cash Processing Solutions Limited or its customers' business, Cash Processing Solutions Limited accepts no responsibility or liability for such content.
You are advised to ensure that you have adequate virus protection as Cash Processing Solutions Limited does not accept liability for any viruses.
Cash Processing Solutions Limited (company No.10069434) is registered in England with their registered office at: Matrix House, Basing View, Basingstoke, Hampshire RG21 4DZ.
************************************************************
#_Single_Disclaimer_1.0