topic Block Access Points with NAC in ExtremeCloud IQ- Site Engine Management Center

Block Access Points with NAC

Matthew_Perry — Thu, 31 Aug 2017 22:57:00 GMT

I'm trying to create a nac rule to block students from putting access points on our network and extending our network unsecurely. I think I could key of of Device Type but don't see any matching type. Is there a way to add types to the system?

RE: Block Access Points with NAC

Steve_Ballantyn — Thu, 31 Aug 2017 23:09:00 GMT

Hello, are you using Extreme for your wireless? If so, this is something you can do easily with Radar (rogue AP detection).

RE: Block Access Points with NAC

Joshua_Puusep — Fri, 01 Sep 2017 01:23:00 GMT

We are, but we're not only concerned with wireless access. We would like to use NAC to block wired switches/routers as well.

RE: Block Access Points with NAC

ar1 — Fri, 01 Sep 2017 11:15:00 GMT

Hello,
we are using NAC with MAC authentication.
Known MAC address are in End Systems group and our rules "move" the devices into a VLAN and the device get access.
The rules looks like "if the MAC address of the device is in a End System Group and the authentication type is MAC then use the accept policy ...".
If no rules match the last rule is the catch-all rule that will collect all unknown devices.
And our catch-all rule will put all devices in our guest vlan. But in your case I would change it that all unknown MAC address will deny.
So you don't need to deny special address and catch-all unknown devices.
I hope this will help you,
Axel

RE: Block Access Points with NAC

Ronald_Dvorak — Fri, 01 Sep 2017 14:18:00 GMT

The system IDs the device via DHCP fingerprinting.

In the past I've used the below article to create a GTAC ticket so unknown devices could get implemented into the system.

https://gtacknowledge.extremenetworks.com/articles/How_To/NAC-Troubleshooting-Tips-Debug-Methodology...

In your case I don't think that would work as there are too many AP vendors out to ID them all correctly.

RE: Block Access Points with NAC

Joshua_Puusep — Fri, 01 Sep 2017 14:18:00 GMT

That's pretty much what I thought. We were hoping to get at least some of the vendors in the system preemptively before school starts. Thanks for the article.

RE: Block Access Points with NAC

Ronald_Dvorak — Fri, 01 Sep 2017 19:09:00 GMT

I've wrote an article on how to create DHCP fingerprints....

https://community.extremenetworks.com/extreme/topics/create-a-extremecontrol-nac-dhcp-fingerprint