topic Is it possible to allow only devices with certificates to authenticate on 802.1x? in ExtremeCloud IQ

Is it possible to allow only devices with certificates to authenticate on 802.1x?

gshipp — Fri, 16 Jul 2021 23:32:16 GMT

We have corporate SSID configured with 802.1x and most of our company assets have a certificate that allows them to connect. But, anyone with AD credentials can connect using their username/password on devices without a cert installed. We want to require a certificate on the device in order for it to be able to connect to the corporate SSID. We’ve had issues with users connecting personal devices using their username/password and we want to prevent this.

Re: Is it possible to allow only devices with certificates to authenticate on 802.1x?

Tomasz — Sat, 24 Jul 2021 02:22:52 GMT

Hi,

I can’t recall if built-in XIQ RADIUS can work with EAP-TLS but you can always force XIQ APs to forward auth requests to your NAC/RADIUS server (like NPS or EAC or any other) and over there you’ll have to allow only EAP-TLS and not PEAP if you don’t want to permit user credentials to be allowed.

Hope that helps,

Tomasz

Re: Is it possible to allow only devices with certificates to authenticate on 802.1x?

Prashath — Wed, 11 Aug 2021 11:49:43 GMT

Hi @Tomasz

I’ve the same issue. Anyone with their AD credential they can login to personal device as well. How to prevent this personal device login over AD credential? They only want to allow corporate device.

We can control via the MAC based filter but they more than 3500 devices.

Re: Is it possible to allow only devices with certificates to authenticate on 802.1x?

Tomasz — Thu, 12 Aug 2021 04:13:36 GMT

Hi Prashath,

Well, host-based auth with certificates (EAP-TLS) seem to be an option here.

Otherwise, in case of user-based auth you will have to have some other way to verify if the device is corporate or not.

If we used Extreme Access Control, there should be an option to import a list of MAC addresses. I didn’t try to create End-system group that big though (but worth trying if host-based auth is not possible).

Hope that helps,

Tomasz