topic RE: Configure RADIUS Authentication mode in ExtremeCloud IQ- Site Engine Management Center

Configure RADIUS Authentication mode

Stefan — Thu, 07 Jan 2016 18:59:00 GMT

Dear community members,
I am trying to do radius user authentication from NetSight (6.3.0.168) with Microsoft NPS.
User authentification fails, for NetSight uses PAP but CHAP is needed.
Where can NetSight be configured for using CHAP instead of PAP ?

RE: Configure RADIUS Authentication mode

Ronald_Dvorak — Thu, 07 Jan 2016 19:03:00 GMT

Do you like to authenticated wireless/wired clients or do you mean authenticate the client that access the Netsight GUI ?

-Ron

RE: Configure RADIUS Authentication mode

Stefan — Thu, 07 Jan 2016 19:03:00 GMT

I want to autheticate clients that can access the NetSight GUI.

RE: Configure RADIUS Authentication mode

Ronald_Dvorak — Thu, 07 Jan 2016 20:22:00 GMT

You are right I get the same error.

The help state the following...

NOTE:The RADIUS Authentication mode supports PAP, CHAP, and MD5 authentication types.

... but I can't find an option to set it anywhere.

Looks like we'd need someone from the Netsight team to answer that.

-Ron

RE: Configure RADIUS Authentication mode

Joseph_Burnswor — Thu, 07 Jan 2016 22:15:00 GMT

After looking around, it looks like you will need to make a new Advanced Radius configuration.

In the new Config, you can choose your authentication type.

Once you complete that, you go to "Authorization/Device access" and under "Users/Groups" you would choose your new Radius config under "Authentication Method"

Let us know if this helps 🙂

RE: Configure RADIUS Authentication mode

Stefan — Thu, 07 Jan 2016 22:15:00 GMT

Hi Joseph,
I created new AAA configuration as proposed with authentication type MsCHAP and saved it..
But when I go to "Authorization/Device access" and under "Users/Groups" I do not see newly created Radius config under "Authentication Method" to choose.
What is wrong ?

RE: Configure RADIUS Authentication mode

Joseph_Burnswor — Thu, 07 Jan 2016 22:15:00 GMT

Did you enforce your changes?

RE: Configure RADIUS Authentication mode

Stefan — Thu, 07 Jan 2016 22:15:00 GMT

Sorry, there is nothing to enforce; I am not using a NAC appliance.
I want to use Microsoft NPS a radius server.

RE: Configure RADIUS Authentication mode

Matthew_Hum1 — Thu, 07 Jan 2016 22:15:00 GMT

You can always enable PAP for a specific connection request policy in NPS.

RE: Configure RADIUS Authentication mode

Stefan — Thu, 07 Jan 2016 22:15:00 GMT

But thats not the problem;
The user guide states:
NOTE:The RADIUS Authentication mode supports PAP, CHAP, and MD5 authentication types.
But CHAP is not working.

RE: Configure RADIUS Authentication mode

Ronald_Dvorak — Thu, 07 Jan 2016 22:15:00 GMT

I think you'd need to open a GTAC ticket for this.

I'm with you.... the NOTE should also tell that you'd only do it with a NAC license.

-Ron

RE: Configure RADIUS Authentication mode

Ronald_Dvorak — Thu, 07 Jan 2016 22:58:00 GMT

You mean the AAA-advanced config in the NAC Manager correct ?

RE: Configure RADIUS Authentication mode

Joseph_Burnswor — Thu, 07 Jan 2016 23:09:00 GMT

yessir, sorry about that

RE: Configure RADIUS Authentication mode

Ronald_Dvorak — Thu, 07 Jan 2016 23:37:00 GMT

Thanks a lot !!!

So someone with only a base Netsight license can't configure it as they don't have access to the NAC manager because the app is unlicensed 

RE: Configure RADIUS Authentication mode

Joseph_Burnswor — Fri, 08 Jan 2016 00:14:00 GMT

As an alternate, you could use LDAP for this. I do believe that is is all versions. Please correct me if I am wrong on that

RE: Configure RADIUS Authentication mode

Stefan — Fri, 08 Jan 2016 00:14:00 GMT

YES, LDAP is working, but this is not the solution for the problem.
The user guide states:
NOTE:The RADIUS Authentication mode supports PAP, CHAP, and MD5 authentication types.
But CHAP is not working.

RE: Configure RADIUS Authentication mode

Ronald_Dvorak — Fri, 08 Jan 2016 00:28:00 GMT

LDAP works fine and I personaly have a NMS-U license so not a big deal for myself

It's just weird that the function requires NAC manager to configure and I wonder whether is should be that way.