topic Re: Extreme NAC, Strong Certificate Mapping Enforcement Microsoft in ExtremeControl

Extreme NAC, Strong Certificate Mapping Enforcement Microsoft

gbrown — Wed, 26 Feb 2025 20:09:28 GMT

With the recent change Microsoft has made regarding Strong Certificate Mapping, I am wondering if there are any potential issues anyone has had with their Extreme NACs/Site Engine (on prem). We have not yet installed the update from Microsoft to enforce this but will do so soon. I also need to update the certs on the NACs anyways and just wanted to check if anything special needed to be done to comply with this update.

All feedback is appreciated.

Re: Extreme NAC, Strong Certificate Mapping Enforcement Microsoft

Robert_Haynes — Thu, 27 Feb 2025 18:42:08 GMT

My quick answer is I simply do not know.

I referred to https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16 for information on this and my take is none of those enforcement modifications will impact Control.

For EAP-TLS Control verifies certificate authenticity based on matching AAA Trusted Certificates (i.e. did the root/inter sign the client cert, etc). For NTLM looking for machine auth as long as Control is able to continue doing lookups via LDAP / RPC I don't see the makeup of the certificate impacting design.

... could be completely wrong tho.

Re: Extreme NAC, Strong Certificate Mapping Enforcement Microsoft

Ryan_Yacobucci — Sat, 01 Mar 2025 02:29:02 GMT

We have seen Control with proxy RADIUS using EAP-TLS to NPS affected by this issue, as Control is only acting as a proxy and the NPS server is enforcing certificate security requirements.

Thanks
-Ryan