topic Re: EAC Join to domain need? in ExtremeControl

EAC Join to domain need?

rgarciapow — Thu, 04 Apr 2024 06:49:35 GMT

Hello,

I have a question about EAP design, the join to domain is necessary in EAC to use EAP-PEAP_MSCHAP_v2 and EAP-TLS?, What is the reason?

I read in other forums that to use EAP-TLS is not necessary doing join but I am not sure of this.

Regards

Re: EAC Join to domain need?

Stefan_K_ — Thu, 04 Apr 2024 08:02:28 GMT

Correct, not needed for EAP-TLS.

Re: EAC Join to domain need?

Robert_Haynes — Thu, 04 Apr 2024 12:50:21 GMT

Domain Join is technically not required for EAP-TLS as the credentials are presented in the client certificate exchange and validated against the AAA trust store.

However the design of Control is to 'join' the domain for any configured LDAP server and this is to ensure functionality if any other 802.1x method is being used. If you want to perform additional functions for LDAP lookup of user attributes or the like these would still require Control to join the domain as well.