topic provisioning XIQ APs as RADIUS clients in XIQ-SE in ExtremeCloud IQ- Site Engine Management Center

provisioning XIQ APs as RADIUS clients in XIQ-SE

Jan_Reister — Wed, 03 May 2023 12:47:24 GMT

We must provision a few hundred XIQ APs to use our Site Engine NAC and related RADIUS servers in the same way our wireless controllers do.

Extreme Control has the concept of "switch" IPs that are IP addresses configured as authorized to contact a RADIUS server. It only accepts individual IPs, no CIDR subnets.

In an XIQ deployment, each AP will have to contact the RADIUS servers. How do we configure the Extreme NAC so that it accepts connections from hundred, potentially thousand APs?

Re: provisioning XIQ APs as RADIUS clients in XIQ-SE

Robert_Haynes — Thu, 04 May 2023 12:48:22 GMT

This is currently a design limit w.r.t. your needs. You would need to inventory these APs in XIQ-SE as Ping Only managed devices and then add them individually as Switches (authenticators) to Control... this of course is if each individual AP is its own RADIUS client.

Re: provisioning XIQ APs as RADIUS clients in XIQ-SE

Zdeněk_Pala — Thu, 04 May 2023 14:10:02 GMT

There is a workflow that will synchronize XIQ APs from XIQ to XIQ-SE and add them to control. If the IP address of the AP changes then the workflow will update it.

check the GitHub = https://github.com/extremenetworks/ExtremeScripting/blob/master/XMC_XIQ-SE/oneview_workflows/README.md#xiq-site-engine-xmc-daily-job-workflows

workflow is called "XIQ AP import".

If you add APs through SNMP there are some benefits (re-authentication method is automatically recognized).

Adding APs as Ping Only works also but the reauth method must be set manually... I prefer the workflow 🙂

Re: provisioning XIQ APs as RADIUS clients in XIQ-SE

Jan_Reister — Fri, 05 May 2023 07:54:28 GMT

Thank you @zdenek_pala @James_A , I will check it out.

Yes @Robert_Haynes it's a limit. I wonder how other XIQ users are managing their NAC, perhaps with a third party(other vendor solution?.

Re: provisioning XIQ APs as RADIUS clients in XIQ-SE

Zdeněk_Pala — Fri, 05 May 2023 13:05:32 GMT

AFAIK customers are using long DHCP lease times for APs. In case of the AP is down for a longer time the IP still will be the same.

The workflow mentioned can be executed periodically (scheduled).