topic Can't select user groups in authentication mapping in ExtremeCloud IQ- Site Engine Management Center

Can't select user groups in authentication mapping

JohanHendrikx — Thu, 08 Aug 2019 16:47:39 GMT

In the EAC you can configure the authentication rules in the AAA section. in one of those rules (Management Login) I want to configure an user group .

According to the help file ,should this be possible.

User/MAC/Host
Select the Pattern radio button and enter the username, MAC address, or hostname that the end-system must match for this mapping. Or, select the Group radio button and select a user group or end-system group from the drop-down list. If you enter a MAC address, you can use a colon (:) or a dash (-) as an address delimiter, but not a period (.).

The only groups I can select are End-System Groups.

How can I select an user groups ?

Re: Can't select user groups in authentication mapping

JohanHendrikx — Fri, 09 Aug 2019 15:05:06 GMT

Extra information: I cann't select LDAP user groups that are created.

Re: Can't select user groups in authentication mapping

Ryan_Yacobucci — Sun, 11 Aug 2019 00:51:02 GMT

Hello Johan,

LDAP usergroups can only be used in the AAA with authentication type "Registration (Auth&Admin)".

Are you looking to send management authentications to a different authentication server based on LDAP group membership, or prevent access based on group membership?

If you're looking to prevent access based on LDAP membership the way you would do that is create a rule in the rules engine with LDAP usergroup that had an accept with appropriate management access AVPs, and below this rule create another rule for all management requests to would deny.

That way unless you're part of the LDAP group configured in the first rule you'll fall into a deny role.

Let me know if this is what you're looking for.

Thanks
-Ryan

Re: Can't select user groups in authentication mapping

JohanHendrikx — Thu, 15 Aug 2019 16:37:41 GMT

I've made roles and tested a connection to a swtich and a connection to an EWC controller.

Both systems have the same EAC controlers.

When connecting to the EWC with wrong credentials , the connection is refused.
When I do the test to a switch I can loging and have user rights.

Did I forgot something?

Re: Can't select user groups in authentication mapping

Ryan_Yacobucci — Sat, 17 Aug 2019 23:17:02 GMT

I"d have to take a look at the configuration.

If you look at the Alarms & Events --> Events --> Type of "NAC" or "Access Control Engine".

When you login to the switch and the controller take a look at those events. Did they hit the same rule?

Does the rule they hit indicate they were returned a "reject"?

Thanks
-Ryan

Re: Can't select user groups in authentication mapping

JohanHendrikx — Wed, 21 Aug 2019 13:30:09 GMT

Results
Management login to switch 10.2.112.211. No Access granted for User: x326000, due to NAC Filter-Id: Enterasys:version=1:policy=Deny Access, Profile: Registration Denied Access NAC Profile Authentication Protocol: PAP, Request Attributes - Service-Type: 1, User-Name: x326000, Calling-Station-Id: 00-00-00-00-00-00, NAS-IP-Address: 10.2.112.211, OPENFLOW_DATAPATH_ID: 19706979330, NAS-Identifier: SW-A11, Called-Station-Id: 00-04-96-A0-A4-02, NAS-Port-Type: 5, NAS-Port: 0, Source-Address: 10.2.112.211 - Response Attributes - Filter-Id: Enterasys:version=1:policy=Deny Access - This is an administrative request because the MAC is zeros: 00-00-00-00-00-00, username is not null and no EAP-Message, MS-CHAP-Challenge or Tunnel-Client-Endpoint is present.

Management login to wireless controller 10.2.112.3. No Access granted for User: x326000, due to NAC Service-Type: null, Profile: Registration Denied Access NAC Profile Authentication Protocol: PAP, Request Attributes - Service-Type: 7, User-Name: x326000, NAS-IP-Address: 10.2.114.1, NAS-Identifier: EWC, NAS-Port-Type: 5, NAS-Port: 0, Source-Address: 10.2.112.3 - Response Attributes - Filter-Id: Enterasys:version=1:policy=Deny Access, Login-LAT-Port: 0 - This is an administrative request because the MAC is null, username is not null and no EAP-Message, MS-CHAP-Challenge or Tunnel-Client-Endpoint is present.

Re: Can't select user groups in authentication mapping

Ryan_Yacobucci — Wed, 21 Aug 2019 19:31:09 GMT

The switch might be allowing you in just because the Access was "Accept". Can you change the "Denied Access NAC profile" and set it to "Reject authentication requests".

It will be the option at the top of the profile.

Thanks
-Ryan

Re: Can't select user groups in authentication mapping

JohanHendrikx — Wed, 21 Aug 2019 20:19:40 GMT

Ryan, this works. Thanks for the solution