topic Re: RADIUS Proxy Via NAC Eth1 in ExtremeCloud IQ- Site Engine Management Center

RADIUS Proxy Via NAC Eth1

Anonymous — Thu, 27 Feb 2020 01:37:56 GMT

Hi,

To keep it as simple as I can…….

Have a scenario where the NAC Eth1 and EWC ESA1 both exist in the DMZ.

The solution requires a captive portal that I am intending on presenting via NAC with ‘Authorised Registration’ that uses proxy RADIUS to authenticate clients. The web redirect on the EWC will point to the NAC Eth1 DMZ address.

In the addition the proxy RADIUS server will be in the DMZ and require the NAC Eth1 source IP to be used to authenticate against it. Essentially adding the NAC Eth1 IP address as the client address in the proxy RADIUS server..

My question is: is that possible or will RADIUS proxy authentication requests come from NAC Eth0?

Many thanks in advance

Re: RADIUS Proxy Via NAC Eth1

Miguel-Angel_RO — Thu, 27 Feb 2020 04:11:17 GMT

Martin,

When you edit your interface, you cannot bind the AAA server to eth1, the radius request will come from eth0.

Mig

Re: RADIUS Proxy Via NAC Eth1

Anonymous — Thu, 27 Feb 2020 04:17:50 GMT

Hi Mig,

Thank you for getting back to me.

Think in that case I will spin up another NAC dedicated for the purpose.

Appreciate the clarification, least I know what I need to do.

Many thanks,

Martin

Re: RADIUS Proxy Via NAC Eth1

Ryan_Yacobucci — Sun, 01 Mar 2020 02:38:45 GMT

Hello Martin,

I believe that you should be able to do this.

You cannot move management services off of eth0 but you can move AAA servers and end system services to eth1 to have captive portal and proxy radius both served from eth1.

You can only have AAA servers on 1 interface though so you can’t have NAC proxy RADIUS out both eth0 and eth1 at the same time.

Thanks

-Ryan