topic RE: NAC - VSP/ERS switch management using LDAP credentials in ExtremeSwitching (VSP/Fabric Engine)

NAC - VSP/ERS switch management using LDAP credentials

Jay6 — Mon, 11 Jun 2018 19:07:00 GMT

I am trying to use NAC to allow switch management access (SSH/Telnet/Web) for an LDAP group.
Currently the VSP/ERS switches have been added to XMC NAC and I am able to backup configs, use scripts, etc. I am also able to assign VLANs to the ports via LDAP authentication.
Does anyone have instructions on how to configure NAC Policy to send the correct values to the VSP/ERS switches to allow management access?

RE: NAC - VSP/ERS switch management using LDAP credentials

Ryan_Yacobucci — Mon, 11 Jun 2018 19:37:00 GMT

Hello James,

Give this article a shot:

https://gtacknowledge.extremenetworks.com/articles/How_To/allowing-mangement-access-to-Avaya-switche...

:edit: you'll need to create a rule with an LDAP user group criteria, but this article details the AVP that should work for management login :edit:

Thanks
-Ryan

RE: NAC - VSP/ERS switch management using LDAP credentials

Jay6 — Mon, 11 Jun 2018 19:37:00 GMT

Ryan,
Thank you. This is what I was looking for.
Is there a way we can append an article to add the VSP/ERS RADIUS commands?

RE: NAC - VSP/ERS switch management using LDAP credentials

Ryan_Yacobucci — Mon, 11 Jun 2018 19:37:00 GMT

Hello James,

It can be appended, do you have a working configuration I can use to add content to the article?

Thanks
-Ryan

RE: NAC - VSP/ERS switch management using LDAP credentials

Jay6 — Mon, 11 Jun 2018 19:37:00 GMT

Yes, Below are the commands for VSP8284 v7.0.
enable
config terminal
radius server host key used-by cli enable
(optional) radius reachability mode status-server
radius enable

RE: NAC - VSP/ERS switch management using LDAP credentials

ar1 — Mon, 11 Jun 2018 19:42:00 GMT

Hi,
I guess the RADIUS server has to send back the RADIUS Attribute "Filter-ID" with the following information (for Enterasys switches):
Enterasys:version=1:mgmt=su:Detailed information may be availabe if you search for "filter-id" in the knowledge base (i.e.:
https://gtacknowledge.extremenetworks.com/articles/Q_A/What-filter-id-is-required-for-administrative...

Hope this will be helpful.
Regards,
Axel