topic Re: How can NAC accept PC that send a PXE request? in ExtremeSwitching (EXOS/Switch Engine)

How can NAC accept PC that send a PXE request?

JohanHendrikx — Tue, 03 Sep 2019 17:55:17 GMT

I have a challenge. Our pc's authenticate with 802.1x to a vlan. This works fine. However when I have to reinstall a pc, the pc must connect to the PXE server after the boot.

How can I let the pc authenticate to NAC and solve this issue ?

Re: How can NAC accept PC that send a PXE request?

jeronimo — Tue, 03 Sep 2019 18:00:11 GMT

You will probably have to configure an "unauthenticated" VLAN and put the DHCP/TFTP server and all other required hosts in it.

See for example: https://www.extremenetworks.guru/exos-802-1x/

Re: How can NAC accept PC that send a PXE request?

Matthew_Hum — Wed, 04 Sep 2019 12:53:53 GMT

If you have coordinated work, you can put in a MAC override for the PC you are working on to put it into a separate VLAN (like a PXE VLAN and not a normal user VLAN) while you reimage it. Just remember to remove the MAC override when you have completed.

Re: How can NAC accept PC that send a PXE request?

JohanHendrikx — Thu, 05 Sep 2019 17:31:51 GMT

I noticed when I was testing that the Device family is Network Booloader and the device typ is PXE Client (ZEN).
Can we use those enty's?

Re: How can NAC accept PC that send a PXE request?

Matthew_Hum — Thu, 05 Sep 2019 22:11:55 GMT

Yes. you can create a new end system group based on device type and then create a new rule to allow it access to the network or whichever VLAN you like.

Re: How can NAC accept PC that send a PXE request?

JohanHendrikx — Fri, 06 Sep 2019 16:02:09 GMT

Unfortunately, this does not work. During the boot, this information isn't available for EAC.

Re: How can NAC accept PC that send a PXE request?

Matthew_Hum — Mon, 09 Sep 2019 00:05:51 GMT

if you get a good capture of the PXE boot sequence, you might be able to write your own DHCP/bootp signature to distinguish your PXE boot process (not sure until I look at a capture of the process itself). This might not be the same for all vendor's machines (e.g. intel boards/chips may pxe differently than non-intel like MSI).

So without that you can use your unauthenticated VLAN for PXE booting, or create overrides for a MAC (this can be scripted and automated) to be put on a different PXE vlan.
or examine your process of reimaging machines.

Re: How can NAC accept PC that send a PXE request?

Chad5 — Wed, 26 Feb 2020 00:30:19 GMT

Hi,

As I was researching, I saw something that might help.

https://www.asquaredozen.com/2018/07/29/configuring-802-1x-authentication-for-windows-deployment/

For step number 5, can we not use XMC APIs to perform the same thing they performed with Cisco ISE External RESTful Service?

I am also wondering if the script mentioned by Matthew is the idea behind the other steps of the guide.

Thanks,