topic Re: XIQ - How can I enable wired 802.1x port authentication in ExtremeCloud IQ

XIQ - How can I enable wired 802.1x port authentication

StephanH — Tue, 26 Jan 2021 06:08:19 GMT

Hello,

how can I enable wired 802.1x authentication for an XIQ AP so that the AP authenticate on a switch port?

Re: XIQ - How can I enable wired 802.1x port authentication

SamPirok — Tue, 26 Jan 2021 22:08:15 GMT

In general you should be able to set that up in the switch template, but if you can let me know which switch model you are using I can be more specific?

Re: XIQ - How can I enable wired 802.1x port authentication

StephanH — Wed, 27 Jan 2021 06:37:44 GMT

Hello Sam,

apparently I have not described this clearly. I want to know where I have to enable the authentication at the AP. Typically there is a place where I say use which data he takes and what method to use, for example, for PEAP (User and Password) or EAP-TLS (Certificate). Enable authentication on the switch is no problem.

Re: XIQ - How can I enable wired 802.1x port authentication

CWurm — Wed, 27 Jan 2021 22:19:45 GMT

Hi Stephan,

I would like to know this as well. IdentiFi APs have been able to do this and could authenticate themselves on their wired port by 802.1X PEAP or EAP-TLS but I haven’t seen any possibility on XIQ APs to do the same…

Kind regards

Christian

Re: XIQ - How can I enable wired 802.1x port authentication

StephanH — Wed, 27 Jan 2021 22:22:48 GMT

Hello Christian,

good, then I'm not the only blind :-).
XCA can do that like Identifi. But in both cases you have to configure something to make the authentication start.

I assume that XIQ can do that too. The only question is where to set it.

Re: XIQ - How can I enable wired 802.1x port authentication

CWurm — Thu, 28 Jan 2021 01:59:31 GMT

Probably that needs to be set through a supplemental CLI command 🙂 Maybe someone of Extreme (or former Aerohive) could help with pointing us in the right direction.

I would be surprised if the XIQ APs could not do that on their ethernet ports...

Kind regards

Christian

Re: XIQ - How can I enable wired 802.1x port authentication

StephanH — Thu, 28 Jan 2021 02:55:00 GMT

Oops wrong button. The question has not been answered yet.

Re: XIQ - How can I enable wired 802.1x port authentication

SamPirok — Thu, 28 Jan 2021 04:38:02 GMT

Hey guys, I ran this past our XIQ support team and they confirmed you don’t need any settings on the AP for this, it would all be set up on the switch ports. Just to make sure I’m understanding correctly, we’re talking about setting up port authentication on the switch port that the AP is plugging in to, correct?

Re: XIQ - How can I enable wired 802.1x port authentication

StephanH — Thu, 28 Jan 2021 04:57:05 GMT

Hello Sam.

yes that’s correct. But as I mentioned above we are used to configuring the AP with the suiteable cred.

On Identifi Wireless for example we have to add username and password for PEAP or if we use EAP-TLS we have to add a certificate to the AP.

In the mention scenario the XIQ AP is the supplicant, the switch is the authenticator and the third part is a radius server (for example a Microsoft NPS, A3 or Extreme Control).

If there is no config necessary on the XIQ AP, how does the AP determain if he has to use PEAP or EAP-TLS and where can we configure username and password for PEAP?

Here is a link to the corresponding configuration on Identifi:

https://documentation.extremenetworks.com/Wireless/UG/Wireless/User_Guide/t_setting_up_802_1x_authentication_for_a_wireless_ap.shtml

Re: XIQ - How can I enable wired 802.1x port authentication

reinhardg — Thu, 28 Jan 2021 16:41:42 GMT

Please have a look onto this topic:

Re: XIQ - How can I enable wired 802.1x port authentication

StephanH — Thu, 28 Jan 2021 18:55:53 GMT

Hello Reinhard,

thank you for the hint. There is lot of text in the mentioned topic.

What I can read is:

There is no possibility to confige the authentication in the GUI
It is (was) possible to configure 802.1x via CLI but it seems only PEAP (but not supported because of CLI)
Maybe there is a FR but I can’t see if there is really one

NAC (Extreme Control) is the key differentiator between Extreme and other vendors. And MAC authentication is not really secure. I can't believe that this feature (802.1x) is not supported.

Re: XIQ - How can I enable wired 802.1x port authentication

StephanH — Thu, 28 Jan 2021 18:56:46 GMT

Reinhard,

are you still using 802.1x with PEAP and XIQ APs?

Re: XIQ - How can I enable wired 802.1x port authentication

reinhardg — Thu, 28 Jan 2021 20:10:39 GMT

Hello Stephan,

yes, with the GUI of XIQ it is not possible to configure 802.1x.

With the CLI PEAP is the default. MD5, TLS and TTLS is also possible, i.e.: supplicant name_of_supplicant eap-type md5 (https://docs.aerohive.com/330000/docs/help/english/ng/Content/reference/docs/cli-reference-guides.htm)

I’ve requested an according FR at my sales engineer some months ago, but didn’t get an answer, yet.

Our production env is still under HM Classic. We are testing XIQ so that we can decide whether to migrate or replace all that stuff with HW of a vendor that has better support (or should I say: Support at all?)

Re: XIQ - How can I enable wired 802.1x port authentication

SamPirok — Thu, 28 Jan 2021 23:11:23 GMT

Thank you for jumping in here Reinhard, I can confirm that we are limited to MAC authentication in this scenario.

@reinhardg, could you please forward me the email chain where you brought up your feature request? I’ll find you a different contact so we can get you a response, it’s unacceptable that you didn’t hear anything back.

@StephanH , in addition to Reinhard’s feature request, the more requests we get for a certain feature, the more of a priority we can make it. I would encourage you to also submit a feature request for this so our engineers can see the demand for that functionality.

Re: XIQ - How can I enable wired 802.1x port authentication

StephanH — Thu, 28 Jan 2021 23:34:11 GMT

Hello Sam,

I will open a request.

I think @CWurm has the same need maybe he can open a feature request, too.

Re: XIQ - How can I enable wired 802.1x port authentication

CWurm — Sat, 30 Jan 2021 00:50:13 GMT

@reinhardg thank you for your hint! Good to see that it is possible to enable 802.1X via supplemental CLI commands on an AP. I will try this in my test lab in the next few days to verify if that works 🙂

However with supplemental CLI we can only push a single credential across all devices which might be sufficient for some customers but not for all. I think I will open up a feature request as well to have this option available in the CLI and to have it customizable for every single AP as well.

Kind regards

Christian

Re: XIQ - How can I enable wired 802.1x port authentication

reinhardg — Tue, 02 Feb 2021 17:53:02 GMT

@CWurm With XIQ (on-prem) you can attach a supplemental CLI at network policy level (“Additional Settings” → “Policy Settings” → “Supplemental CLI”) as well as at AP level (“Device Configuration” → “Supplemental CLI”). Is this what you need?

Re: XIQ - How can I enable wired 802.1x port authentication

CWurm — Tue, 02 Feb 2021 20:34:01 GMT

Thank you very much! I haven’t seen this setting before This is very nice to know that you can also bind a supplemental CLI to each AP individually.

Can you combine both settings, i.e. have a supplemental CLI for the whole network policy and also one on the AP or can you only enable supplemental CLI in one place?

Kind regards

Christian

Edit: nevermind my question. I saw you can set to either combine both supplemental CLIs or use the device-level supplemental CLI setting as an override 🙂

Re: XIQ - How can I enable wired 802.1x port authentication

StephanH — Wed, 03 Feb 2021 23:56:15 GMT

Ok,

Reinhard. 802.1x with CLI works fine. Thank you for your help.