topic Re: Add IP Range devices to Access Control in ExtremeControl

Add IP Range devices to Access Control

EF — Mon, 21 Apr 2025 12:08:30 GMT

Hi Team,

when you add a device to Access control it must exist in Network tab or be created at this moment, and it´s ok for a few devices, but this is a problem when you got a lot of devices and more big problem if they got IP by DHCP, for example XIQ APs.

Is there any way to create an "IP Range" or use regular expressions to create Access Control clients?

If not, I cant understand why is not implemented yet.

Cheers!!

Re: Add IP Range devices to Access Control

Zdeněk_Pala — Tue, 22 Apr 2025 12:13:34 GMT

Hi EF.

ExtremeControl knows how to talk to the device based on SNMP information. that is the reason for the need to add devices to the network tab.
For XIQ APs you can use the workflow that synchronizes the APs from XIQ to the Site Engine/Control.

Hope it helps

Re: Add IP Range devices to Access Control

Robert_Haynes — Tue, 22 Apr 2025 12:41:44 GMT

The XIQ AP import workflow @ https://github.com/extremenetworks/ExtremeScripting/tree/master/XMC_XIQ-SE/oneview_workflows and directly @ https://github.com/extremenetworks/ExtremeScripting/blob/master/XMC_XIQ-SE/oneview_workflows/xwf/XIQ_AP_import-24.7.11.22v301.xwf

Re: Add IP Range devices to Access Control

EF — Wed, 23 Apr 2025 18:40:35 GMT

Hi Team,

thx for your response but I´m still cant undertand why EAC need "to talk" by SNMP with devices, I got 3K APs, 500 switches, some of them from others manufactures, FWs, etc...

I only want enable them like EACs clients and then return the right atributes matching policies.

About the scripts to sync APs, How often does it run? I see a problem if one AP obtain a diferent IP from DHCP server and there is a delay of minutes.

Regards

Re: Add IP Range devices to Access Control

Zdeněk_Pala — Thu, 24 Apr 2025 14:27:18 GMT

Hi,

You can schedule the workflow to be executed hourly. You can have multiple scheduled entries, so if you schedule the sync job 12 times, it can run every 5 minutes.

A better approach is to set a longer DHCP lease time so that APs do not change their IP addresses on every reboot. AFAIK, this is quite a common approach.

The Access Control Engine reads a lot of metadata from the radius client to provide necessary details in your end system table.

Sincerely yours

Re: Add IP Range devices to Access Control

Zdeněk_Pala — Thu, 24 Apr 2025 14:28:40 GMT

You can also use discovery to add your devices to NAC... that can be scheduled also.

Re: Add IP Range devices to Access Control

Robert_Haynes — Thu, 24 Apr 2025 14:58:14 GMT

You can also add the switches, APs, other devices as Ping Only devices. No SNMP. This will inhibit IP resolution and other SNMP-based exchanges Control would have with SNMP-capable devices. If you opt for this then IP resolution for example will depend on other means like DHCP relay mirroring / snooping or RADIUS Accounting to gleam IP information from the device/network.

Re: Add IP Range devices to Access Control

EF — Tue, 06 May 2025 11:25:47 GMT

Hi Team,

thanks for your responses, but Im still think that sometimes is usefull have a range object because is not needed obtain any other info from the client and only want to allow make RADIUS request.

Thanks a lot for share your knowledge.