topic Switch Management Access using NAC Rules in ExtremeCloud IQ- Site Engine Management Center

Switch Management Access using NAC Rules

Christopher_Tay — Tue, 16 Mar 2021 02:50:50 GMT

I have configured my X460-G2 switches to use NAC for management access.

I have 2 sets of switches and would like 1 AD group to manage any and another to manage just a subset.

The AD authentication and groups work fine. I have tried to set up a rule that uses the “End-System” criteria. I have created an End-System group based on the switch IP (I tried the MAC as well) but the switches IP doesn’t seem to be recognized.

I have RADIUS authentication and accounting enabled.

Is this the correct way to create different access for switches? If so what am I missing?

Is there a different rule I could create to accomplish this?

Thank you,

Chris

Re: Switch Management Access using NAC Rules

Stefan_K_ — Tue, 16 Mar 2021 03:03:33 GMT

Hi Chris,

I have tried to set up a rule that uses the “End-System” criteria. I have created an End-System group based on the switch IP (I tried the MAC as well) but the switches IP doesn’t seem to be recognized.

Use a location group instead of an end-system group and it will work fine.

The location groups can be used for:

limit rules on specific switches (as in this case)
limit rules on specific switch-ports
limit rules on specific access-points

Best regards
Stefan

Re: Switch Management Access using NAC Rules

Christopher_Tay — Tue, 16 Mar 2021 22:39:50 GMT

Hi Stefan,

That worked exactly how I was hoping for.

Thank you for the help

Chris