topic Identifi: What is an easiest way to authenticate users in Active Directory using NAC? in ExtremeWireless (General)

Identifi: What is an easiest way to authenticate users in Active Directory using NAC?

Ilya_Semenov — Sat, 21 Oct 2017 00:54:00 GMT

Hello, everybody,

at the moment I have 120 APs and about 12000 users. Employees's SSID has beautiful authorization webform on Fortigate firewall, users use their Active DIrectory credentials and everything works fine, except I can't see AD accounts of wifi users in Netsight. This makes me very sad(

But I have an installation of mighty NAC!

Is there any step-by-step guide how to configure NAC to authorize AD users using a webform?

Could you please share it!

Many thanks in advance,

Ilya

RE: Identifi: What is an easiest way to authenticate users in Active Directory using NAC?

Diederik_Kuijpe — Sat, 21 Oct 2017 01:28:00 GMT

Why not use RADIUS auth?

RE: Identifi: What is an easiest way to authenticate users in Active Directory using NAC?

Ilya_Semenov — Sat, 21 Oct 2017 01:28:00 GMT

Hi,
what do you mean?

For sure, I could authorize users over Microsoft NPS. But this is enterprise customers, they need a beautiful web page, not just two input string for login/password.

RE: Identifi: What is an easiest way to authenticate users in Active Directory using NAC?

Diederik_Kuijpe — Sat, 21 Oct 2017 01:28:00 GMT

Why's that even a requirement? By utilizing Radius auth you can skip the auth webpage, users simply put in their AD credentials for connecting to the SSID. You then have the users available in Identifi/NetSight and if you enable FSSO polling on the Fortigate you automatically authenticate users for the firewall as well.

I did this to alleviate double sign-ins.

http://cookbook.fortinet.com/fsso-polling-mode/

RE: Identifi: What is an easiest way to authenticate users in Active Directory using NAC?

Ronald_Dvorak — Sat, 21 Oct 2017 02:55:00 GMT

You'd use the AD and ExtremeControl could query the user accounts via LDAP.

Could you post a screenshot of the current web login page that is used - I'd like to see how beautiful it is 🙂

RE: Identifi: What is an easiest way to authenticate users in Active Directory using NAC?

Ilya_Semenov — Sat, 21 Oct 2017 02:55:00 GMT

It's in Russian, Ron, are you sure?) I'll ask the customer for permission on Monday.

It would be great if someone post a link to a guide which will help me to configure web login page in NAC)

RE: Identifi: What is an easiest way to authenticate users in Active Directory using NAC?

Ronald_Dvorak — Sat, 21 Oct 2017 20:09:00 GMT

Could you explain a bit more about the deployment.
What is the security on the WLAN service - is it open/none or WPA PSK or ECP?

RE: Identifi: What is an easiest way to authenticate users in Active Directory using NAC?

Ilya_Semenov — Sat, 21 Oct 2017 20:09:00 GMT

Hi, Ronald,

sure!

This is open SSID without authorization. When user connects to the SSID he tries to reach any of Internet resources and gets to Fortigate FG-600 where he asked for his AD credentials (on the beautiful HTTPS login web page).

That is it!

RE: Identifi: What is an easiest way to authenticate users in Active Directory using NAC?

Ilya_Semenov — Sun, 22 Oct 2017 08:43:00 GMT

Hi, James,

it is open SSID. I'll try to play with NAC without a guide(

Thanks!

RE: Identifi: What is an easiest way to authenticate users in Active Directory using NAC?

Zdeněk_Pala — Sun, 22 Oct 2017 21:57:00 GMT

in the NAC portal choose Authenticated registration. you need to configure AAA to your AD (Radius or LDAP). It should be quite strait forward.

Good luck.

Z.

RE: Identifi: What is an easiest way to authenticate users in Active Directory using NAC?

Ilya_Semenov — Sun, 22 Oct 2017 21:57:00 GMT

Hello, Pala,

Unfortunately, I can't find "Authenticated registrations" menu. I have Netsight 7.

Where could it be located?

RE: Identifi: What is an easiest way to authenticate users in Active Directory using NAC?

Matthew_Hum — Sun, 22 Oct 2017 21:57:00 GMT

Authenticated Registration would be in the portal configurations, in choosing what kind of portal features you are looking for.