topic How to configure XCA or XCC to authenticate domain computers using certificates EAP-TLS in ExtremeWireless (General)

How to configure XCA or XCC to authenticate domain computers using certificates EAP-TLS

Christian_K_ — Sat, 24 Oct 2020 04:56:38 GMT

Hello community,

has anybody found a way to use a modern wireless controller like XCA or XCC with a client auth based on certifcates without using an NPS (we have dozens of ipad´s)

I want to find a way where i can create a machine certificate on a system and then join an SSID without username and passwort but only check this certifcate.

Re: How to configure XCA or XCC to authenticate domain computers using certificates EAP-TLS

Miguel-Angel_RO — Sat, 24 Oct 2020 15:59:56 GMT

Christian,

There are 3 authentication mechanisms in XCC:

Local (username/password)
Radius (all the radius supported auth types)
LDAP (mainly used to validate user or computers on MSAD. with username/password)

If you don’t use local (usrername/password) authentication, you need an external Radius server to perform the authentication.

You can use NPS or another.

The advantage of the Extreme Access Control is the integration with the XCC.

To perform TLS Auth the Radius has to have the Root certificate of the CA used to generate the Client certificate.

With this Root certificate he can validate the Client certificate and give a positive answer to the XCC.

Regards

Mig

Re: How to configure XCA or XCC to authenticate domain computers using certificates EAP-TLS

Christian_K_ — Sat, 24 Oct 2020 16:06:57 GMT

Hello Mig,

thx for the awnser, i don´t want to use NPS because the customer has a lot of IPAD´s and NPS is very focused on windows machines.

I have EAC on the customer site and do LDAP Auth with this.

Do you know a “how to” or “Step by Step” , to configure XCC and EAC using Certificates with EAP Auth ?

I can only find old “How To´s” with NPS and V2110 Controller but nothing with modern controllers like XCA or XCC.

Regards
Christian

Re: How to configure XCA or XCC to authenticate domain computers using certificates EAP-TLS

Miguel-Angel_RO — Sat, 24 Oct 2020 16:27:00 GMT

Christian,

What you request is quite broad and need some professional services to analyse your specific use cases and implementation.

You could have to go in so many menus and options on NAC that it will not possible to share this on this forum.

You’ll also have to manage the certificate deployment on iOS devices for 802.1X authentication. It is quite tricky to do.

Here some step-by-step guides found on the Internet to give you some indications on the configuration steps for NAC:

https://www.securew2.com/solutions/radius-aaa-solutions/integrating-eap-tls-authentication-with-extremecontrol-radius/
https://www.securew2.com/solutions/wi-fi-integrations/how-to-setup-eap-tls-wpa2-enterprise-extreme-networks/
On top of this I recommend to add the XCC to the NAC policy Domain to ensure the correct deployment of the Roles to be used

Regards

Mig

Re: How to configure XCA or XCC to authenticate domain computers using certificates EAP-TLS

Bill_Handler — Mon, 26 Oct 2020 20:34:20 GMT

Christian,

Much of the config will need to be on the NAC/Extreme Control side of things. On the XCA/XCC side, you should only need to point to NAC/EC as the RADIUS Server to authenticate against. There may be more information regarding certificates and NAC in the knowledgebase.

There is no step-by-step guide that I know of for this.

I do believe that it is shown in the Extreme Control class - or you can connect with a Partner that has experience with NAC/EC

Let me know if we can help.

Thanks,

Bill

Re: How to configure XCA or XCC to authenticate domain computers using certificates EAP-TLS

Ovais_Qayyum — Tue, 03 Nov 2020 04:39:16 GMT

Hi Christian,

You can setup computer/machine cert based authentication by following these steps. You would also need to take care of the certificate distribution to your iOS and non-windows devices, that can’t be done with EAC.

1- Point your XCC to the EAC as radius server using the AAA configuration the XCC. Make sure NOT to use local onboarding option in WLAN settings.

2- On the EAC, you need two types of certificates i.e.

Root CA of the domain that is issuing/signing the certs for your client devices.
Radius cert issued by the same domain.

3- Load the CA cert on the “Update Trusted Authorities” under AAA settings in EAC.

4- Update the Radius cert on the EAC as follows:

5- Setup LDAP on EAC to authenticate your machines/computers, make sure you set it up with AD machine default values as per following:

6- Configure AAA rule as per below and make sure you have correct match pattern for host and LDAP settings selected, usually it is host/* or *@* depending on how your directory service is setup.

7- Finally, create an appropriate rule to address the cert based authentication, you either set it to a more generic auth type 802.1x or be more specific and set it to 802.1x EAP-TLS.

8- And most importantly, don’t forget to press the magic “Enforce” button to ensure settings are pushed to EAC.

Let us know how it goes.

Regards,

Ovais