topic Re: Authentication failed for Network Login MAC user in ExtremeControl

Authentication failed for Network Login MAC user

MaKa71 — Thu, 02 Jul 2026 15:49:22 GMT

There is old EXOS switch X430-8p, it does not support Extreme Policy, but it supports netlogin and UPM features. I configured UPM profile in switch, Policy and Rule at NAC, also inserted UPM profile name at port profile at NAC.

At NAC End-Systems table End-System is successfully authenticated and gets correct Profile:
( tcpdump created PCAP file ) RADIUS sends toward the switch:
Vendor-ID: 0x0000077C = 1916 (Extreme Networks)
Vendor-Type: 0xD4 = 212
Vendor-Length: 0x14 = 20
Vendor-Data: "UPM_VLAN_Printerid"

Switch log shows:
07/02/2026 14:19:26.01 <Info:nl.ClientAuthFailure> Authentication failed for Network Login MAC user D4B4C0622270 Mac D4:B4:C0:62:22:70 port 1

i used the 'RADIUS Attributes to send' -> 'Extreme Netlogin - VLAN Name' at NAC

Does anyone have this ( netlogin + UPM without Policy at EXOS switch ) setup working and what 'RADIUS Attributes to send' is in use ?

Re: Authentication failed for Network Login MAC user

Zdeněk_Pala — Mon, 06 Jul 2026 15:05:41 GMT

example:

when user logs in the “create log message "Logon EnterpriseUser UPM executed", when logs out: “create log message "Logoff EnterpriseUser UPM executed"

----------

X440G2.1 # sh configuration upm # # Module upm configuration. # create upm profile UserLogoffProfile create log message "Logoff EnterpriseUser UPM executed" . create upm profile UserLogonProfile create log message "Logon EnterpriseUser UPM executed" . configure upm event user-authenticate profile UserLogonProfile ports 1-6 configure upm event user-unauthenticated profile UserLogoffProfile ports 1-6

------

RADIUS Attributes:

Filter-Id=Enterasys:version=1:%MANAGEMENT%policy=%POLICY_NAME% Service-Type=%MGMT_SERV_TYPE% Extreme-Security-Profile=%PORT_PROFILE%

----

Hope it helps you.

Re: Authentication failed for Network Login MAC user

MaKa71 — Tue, 07 Jul 2026 13:25:14 GMT

"port profile" value syntax is very helpful, thank You !
Are You sure about RADIUS attributes line:

Filter-Id=Enterasys:version=1:%MANAGEMENT%policy=%POLICY_NAME%

because old G1 type EXOS do not support Extreme Policy ?

Re: Authentication failed for Network Login MAC user

Zdeněk_Pala — Wed, 08 Jul 2026 12:29:01 GMT

Hi.

Yeah. that piece is not useful for G1, but it does not harm 🙂

You should have the same result with and without...

Sincerely yours

Re: Authentication failed for Network Login MAC user

dexterwatts — Wed, 08 Jul 2026 12:32:56 GMT

MAC authentication issues on older EXOS switches can be challenging, especially when combining NAC policies, RADIUS attributes, and UPM profiles without full policy support. It looks like the RADIUS response is reaching the switch correctly, but the attribute handling or UPM profile mapping may need further verification. Checking the VLAN assignment configuration and compatibility between NAC and the switch firmware could help narrow down the issue. Similar considerations apply when managing different models of Network Switches in enterprise environments, where authentication and access control need to work together smoothly.

Re: Authentication failed for Network Login MAC user

MaKa71 — Thu, 09 Jul 2026 13:36:52 GMT

when i set Radius Attribute Policy Mapping:

Extreme-Security-Profile=%PORT_PROFILE%

End-System will be unauthenticated.

From switch log i discovered ( when there was typo in profile name ) this instruction:
"Expected format - profile VLAN=test;QOS=qp1;LOGOFF-PROFILE=xyz; "

I played with different port profiles:
UPM_VLAN_Telefonid_event_auth;VLAN=Printerid_K62a;LOGOFF-PROFILE=UPM_port_event_unauth;
UPM_VLAN_Telefonid_event_auth VLAN=Printerid_K62a;LOGOFF-PROFILE=UPM_port_event_unauth;
without success: End-System remained unauthenticated.

Only when i changed Radius Attribute Policy Mapping to:
Tunnel-Type=VLAN
Tunnel-Medium-Type=802
Extreme-Netlogin-Vlan-Tag=%...%
Extreme-Security-Profile=%...%

End-System authenticated and UPM-s executed.

I wonder, why EXOS switch log included instruction "Expected format - profile VLAN=test;QOS=qp1;LOGOFF-PROFILE=xyz; " wich is not working.