topic Re: Extreme Control as External RADIUS in Cloud IQ in ExtremeControl

Extreme Control as External RADIUS in Cloud IQ

RobertD1 — Tue, 22 Feb 2022 12:21:00 GMT

Hello,

I understand that it is possible to create a network policy in Cloud IQ for Wireless which can use External RADIUS server for authentication (Extreme A3, NPS, Extreme Control). Do the APs (AP3705C) which are onboarded in the cloud also need to be added under Access-Control>Switches? If so what RADIUS Attributes should they use?

Thanks,
Rob

Re: Extreme Control as External RADIUS in Cloud IQ

AdminS — Wed, 02 Mar 2022 08:56:02 GMT

Hi Rob, thanks for reaching out. I just wanted to clarify something really quick so I know what team to reach out to for help with this question- are you building the Radius policy out in ExtremCloud IQ or Extreme A3? We'll be able to help you either way, I just want to make sure I take this to the right team to avoid delays here.

Re: Extreme Control as External RADIUS in Cloud IQ

AdminS — Wed, 02 Mar 2022 08:56:16 GMT

Hi Sam,

I have a customer that already has Cloud IQ APs and they are using PSK which has been compromised. They would like a more secure solution where they can assign VLANs for different user types. So, yes I want to use a network policy which uses the Extreme Access Control virtual appliance which is in a secure location at the customer's HQ. EAC and XIQ-SE are able to onboard to Cloud IQ as well as the APs.

Am I right that the APs need to be imported from XIQ into XIQ-SE so that they can be added to Access-Control>Switches? The APs that onboard to the cloud could be in any global location, so missing some facts about how Cloud based APs can use on premise Extreme NAC (not A3) as RADIUS Server using network policy in XIQ.

How is the AP configured under Access-Control>Switches? There is a list of different choices of RADIUS Attributes to Send in the device configuration, what should it be?

Not using Extreme A3.

Extreme Access Control could have local users or integrate with AD database.

Requirement is for 802.1X.

Thanks,
Rob

Re: Extreme Control as External RADIUS in Cloud IQ

AdminS — Wed, 02 Mar 2022 08:56:29 GMT

Update... I have found this document to answer quite a few of the questions I had so I will try this out.

https://documentation.extremenetworks.com/ExtremeCloudIQ/HowTo/ExtremeControl_for_XIQ-SE_and_XIQ_APs_How-to_Guide.pdf

These are the sort of guides we all find useful and give great guidance with examples which are easy to follow and apply. It would be difficult to know what to do otherwise.

Re: Extreme Control as External RADIUS in Cloud IQ

AdminS — Wed, 02 Mar 2022 08:56:42 GMT

I have used the document and managed to get an XIQ WAP to interact with the Access-Control engine. I created three SSIDs and all three worked (for PPSK, Open and Secure).

One thing that failed in my setup was the Workflow to Import the XIQ APs. When I ran it it said it succeeded very quickly as if it did not run through all of the tasks. No APs were added to XIQ-SE and no APs were added to Access-Control.

The output for the workflow showed an error:

Script Name: Process New XIQ Devices_Extract_All_Devices_from_XIQ
Date and Time: 2022-02-24T16:19:51.443
XIQ-SE User: netsight
XIQ-SE User Domain:
IP:
code: GatewayErrorCode.CLIENT_VERIFICATION_FAILED
message: Client Credential verification failed.
rawMessage: XCKCKzThhF
status: 401

I imported the workflow and appeared to succeed but nothing happened. Any ideas?

Thanks
Rob

Re: Extreme Control as External RADIUS in Cloud IQ

AdminS — Wed, 02 Mar 2022 08:56:56 GMT

I think I need to update the script first...

###################################################################
# Update the Bearer Token, client secret, client-id,
# redirect-uri, and ownerid in the curl_cmd variable to
# match your developer credentials, bearer token from
# XIQ, and VIQ ID.
# Developer credentials: https://developer.aerohive.com/
# Bearer Token: XIQ Interface/Global Settings/ API Token Management
# VIQ ID: From the XIQ interface "About" menu option
###################################################################

curl_cmd = 'curl -s -k --header "Authorization: Bearer xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"'
curl_cmd = curl_cmd + ' --header "X-AH-API-CLIENT-SECRET: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"'
curl_cmd = curl_cmd + ' --header "X-AH-API-CLIENT-ID: xxxxxxxx"'
curl_cmd = curl_cmd + ' --header "X-AH-API-CLIENT-REDIRECT-URI: https://x.x.x.x"'
curl_cmd = curl_cmd + ' https://va2.extremecloudiq.com/xapi/v1/monitor/devices{?ownerId=xxxxxx}'

I've found the ownerId and REDIRECT-URI address (my XIQ-SE) but struggling to find the CLIENT-ID and complete

Re: Extreme Control as External RADIUS in Cloud IQ

AdminS — Wed, 02 Mar 2022 08:57:05 GMT

I registered on the developer site and have been able to generate a token. I updated the script, saved it and re-ran the workflow but it fails.

Re: Extreme Control as External RADIUS in Cloud IQ

AdminS — Wed, 02 Mar 2022 08:57:15 GMT

Hello Robert,

That is a great document that was developed by our TME team. I use it myself all the time.

To answer your questions for future use:

The AP's needed to be added into the Control --> Switches tab.

Extreme Control/A3 both can have local users or integration with AD.

Thanks
-Ryan

Adding APs into the Control switches tab will add them to a clients.conf file that will make them authorized for RADIUS communication. Without them in the clients.conf file NAC will not respond to RADIUS requests from their IP address.

We use filter-ID for role assignment with XIQ.

Re: Extreme Control as External RADIUS in Cloud IQ

AdminS — Wed, 02 Mar 2022 08:57:27 GMT

Hi Ryan,

I've used the document to get an AP305C to work with XIQ-SE and Extreme Control. I'm struggling to get the workflow mentioned in the document to work though. Some kind of client authorization issue. I've updated the script as instructed and even tried with root but same issue. I just opened a case to try to get help on it (hoping Gitbhub workflows are supported of course).

Re: Extreme Control as External RADIUS in Cloud IQ

AdminS — Wed, 02 Mar 2022 08:57:37 GMT

I made a little progress and can get an authorized response from the API with a list of devices but the WF does not add them to XIQ/Access-Control. Getting closer.

Re: Extreme Control as External RADIUS in Cloud IQ

AdminS — Wed, 02 Mar 2022 08:57:48 GMT

I have got this to work! After solving the first problem with the developer profile (redirect URI was missing) then the first task passed and data was collected. I then realized the subsequent tasks also had scripts which when reviewed revealed what I needed to do in addition. I had to create a profile for the new device to use (or alter the script) and I added another IF statement for the model of AP I was using (AP305C) and in the last script alter the primary RADIUS server IP. That's it! I've learnt a lot from this and will be very useful for bulk importing and integrating XIQ WAPs with XIQ-SE with Extreme Control.