topic RE: Force a client re-authentication directly via CLI (EXOS / EOS) in ExtremeWireless (General)

Force a client re-authentication directly via CLI (EXOS / EOS)

M_Nees — Fri, 27 Jan 2017 14:00:00 GMT

Hi,

during a HP (2920) Switching / NAC project i learned that MAC or 802.1x re-authentication can be done directly via switch CLI:

code:

aaa port-access mac-based <port-list

> reauthenticate

code:

aaa port-access authenticator

port-list

> reauthenticate

This is a nice feature especially you do not have Netsight NAC with NAC Managers "Force Re-auth" button.

In the past everybody uses a hard port link down/up - but the above command is smarter especially you have multi-user on that regarding port.

Is there a similar command for re-authentication available on EXOS / EOS ??

Regards

RE: Force a client re-authentication directly via CLI (EXOS / EOS)

Zdeněk_Pala — Fri, 27 Jan 2017 14:30:00 GMT

EOS:
set macauthentication portreauthenticate port-string
Use this command to force an immediate reauthentication of the currently active sessions on one
or more MAC authentication ports.

set dot1x {[enable | disable] | [{init | reauth} [port-string] [indexindex-list]]}
init | reauth Reinitializes one or more access entities or reauthenticates one or moresupplicants.

RE: Force a client re-authentication directly via CLI (EXOS / EOS)

M_Nees — Fri, 27 Jan 2017 14:44:00 GMT

Thanks Zdenek !!

Same for EXOS ??? (which is the edge switching platform of the next years ...)

RE: Force a client re-authentication directly via CLI (EXOS / EOS)

M_Nees — Fri, 27 Jan 2017 14:44:00 GMT

Hi Oscar,

thanks for reply !!

Regards

RE: Force a client re-authentication directly via CLI (EXOS / EOS)

OscarK — Fri, 27 Jan 2017 14:44:00 GMT

On EXOS, clear netlogin state

RE: Force a client re-authentication directly via CLI (EXOS / EOS)

André_Herkenrat — Fri, 27 Jan 2017 15:02:00 GMT

This also works with 15.3 Systems. We did some integration with NAC and Assessment, where we forced reauth this way via X-API and NAC.

RE: Force a client re-authentication directly via CLI (EXOS / EOS)

Zdeněk_Pala — Fri, 27 Jan 2017 15:02:00 GMT

CoA (RFC3576 / RFC 5176) is supported on both EOS and EXOS also 

RE: Force a client re-authentication directly via CLI (EXOS / EOS)

M_Nees — Fri, 27 Jan 2017 15:02:00 GMT

Hi Zdenek,

regarding CoA:

EXOS support that started on EXOS V22.1
configure radius dynamic-authorization ...
EOS support this feature only on S/K maybe N-Series - but not on (edge) SecureStacks.
set radius authorization dynamic ...

Searching last V8.61 s-series manuals i found no entry for that feature :-((
is my search wrong or is there no manual entry for that feature ?

Regards

RE: Force a client re-authentication directly via CLI (EXOS / EOS)

Zdeněk_Pala — Fri, 27 Jan 2017 15:02:00 GMT

The RFC3576 works on EOS. It is enabled by default and I have no idea if you can disable it. So no need for documentation. I am sure you will find the RFC in the datasheet. And you are right we do support the CoA in 22.x

RE: Force a client re-authentication directly via CLI (EXOS / EOS)

M_Nees — Fri, 27 Jan 2017 15:02:00 GMT

Hi Andre,

as i tcpdump with current EXOS - Force reauth (from NAC Gateway) is done via dot1x snmp MIB (for both mac and 802.1x).

By the way other switches like H3C provide CoA (Change of Authorization) which is known from Wireless for re-auth. This is also a smart method.

Regards

RE: Force a client re-authentication directly via CLI (EXOS / EOS)

SchmuFoo — Thu, 14 Mar 2019 14:45:00 GMT

"Is Change of Authorization (CoA) supported on EOS switches?

Article Type:
Q & A
Article Number:
000038365
Last Modified:
3/13/2019"

"Environment

EOS
7100-Series
K-Series
S-Series
Securestack
CoA
RFC5176

Answer

RFC5176 Dynamic Authorization Extension to RADIUS is supported on S/K/7100 platforms but not on Securestack switches. "

Source: https://extremeportal.force.com/ExtrArticleDetail?n=000038365