topic Re: AzureAd and dot1X in ExtremeCloud IQ- Site Engine Management Center

AzureAd and dot1X

faste — Mon, 20 Mar 2023 11:33:21 GMT

About to start looking for other solutions now.

We have been using ExtremeControl for some years for .1x logon with both wireless and wired network.

But now we are moving towards AzureAD (currently hybrid). So for now we see a lot of problems with

logins.

1: AzureAD joined PC's are not visible to the NAC.

2: UserAuth works, but it is far from flawless. (had to install NPS proxy because of UPN)

3: Intune plugin is useless because it only does mac-auth based on the wifi mac address on the device. so there will be no workable wired auth. (apart from userAuth).

This has been a problem now since 2019. What are ExtremeNetworks going to do with this ?

Has anybody found a good soloution on this problem ? (I see that sombody asked question as early as 2018)

Re: AzureAd and dot1X

Zdeněk_Pala — Mon, 20 Mar 2023 13:44:30 GMT

There are many flavors of 802.1X.

EAP-TLS can still be used with Azure, certificates are independent of Azure.
The PEAP with MsChapv2 can not be used with Azure cloud as NTLM is not supported there and NTLM can not be translated to SAML/API calls.
If customers want to use PEAP, they deploy local AD with Azure connector to synchronize. Local AD can be used for NTLM or NPS.
We are investigating EAP-TTLS with PAP option as it can be used with Azure cloud as the password can be translated to SAML/API calls to Azure. This is not available with the current version of ExtremeControl.

Re: AzureAd and dot1X

faste — Tue, 21 Mar 2023 08:31:51 GMT

Problem with PEAP /Local AD is that upn is not supported and i've also seen other users having problem with authentication. And as you said. NPS Might be a solution. But in my experience the devices tend to try to authenticate with host/xxx instead of user/xxx and then the user does not get access.

EAP-TLS might be a solution, but then that will only give us the host-id (And it will require a step in installing dev-certs to azure ad joined devices before they are present on network ) .

When will the EAP TTLS/PAP solution be ready, and what will it require of the azure account ? E3/E5 ?