topic RE: L7 ROLE versio 10.21.01 in ExtremeWireless (Identifi)

L7 ROLE versio 10.21.01

Luis_Mendes — Tue, 28 Feb 2017 02:53:00 GMT

I using L7 roles to authenticate. I created a portal (external portal) to authenticate using GMAIL, WINDOWS (OUTLOOK), OR FACEBOOK login to authenticate.

Create rules L7 with these networks and only facebook not work. The customer authenticate with anothers networks.

I need create L7 rules with permit FACEBOOK, GMAIL. But only gmail Works. Any idea, i use ap 3705 and version 10.21.01

RE: L7 ROLE versio 10.21.01

Jeremy_Gibbs — Tue, 28 Feb 2017 03:35:00 GMT

You are trying to create a rule that only allows Gmail, Facebook?

RE: L7 ROLE versio 10.21.01

Jeremy_Gibbs — Tue, 28 Feb 2017 03:39:00 GMT

Can you send a screenshot of the rule you are trying to create?

RE: L7 ROLE versio 10.21.01

Luis_Mendes — Tue, 28 Feb 2017 03:39:00 GMT

Yes, gmail, Microsoft.. Works fine.. but facebook not.. I will test with custom to.. and not works

RE: L7 ROLE versio 10.21.01

Ronald_Dvorak — Tue, 28 Feb 2017 03:43:00 GMT

AFAIK ... Layer 7 Application policy enforcement requires AP38xx+.

RE: L7 ROLE versio 10.21.01

Ronald_Dvorak — Tue, 28 Feb 2017 03:44:00 GMT

https://gtacknowledge.extremenetworks.com/articles/Q_A/What-is-AP-Feature-Compatibility-Matrix-in-V1...

RE: L7 ROLE versio 10.21.01

Luis_Mendes — Tue, 28 Feb 2017 03:44:00 GMT

But if the POLICE is apply on the controller (b@ewc), why ap influence? And why the others app like gmail, Hotmail Works fine

RE: L7 ROLE versio 10.21.01

Jeremy_Gibbs — Tue, 28 Feb 2017 03:44:00 GMT

I was under the impression that the 38xx and 39xx series were required because of the flow based architecture of the AP, allowing it to do the AVC portion. But i'm not 100% sure about that.

RE: L7 ROLE versio 10.21.01

Jeremy_Gibbs — Tue, 28 Feb 2017 03:55:00 GMT

I was going to say that, but I couldn't find the material.

RE: L7 ROLE versio 10.21.01

Ronald_Dvorak — Tue, 28 Feb 2017 04:46:00 GMT

As Jeremy mentioned could you please post a screenshot of the role configuration and the policy rules.

RE: L7 ROLE versio 10.21.01

Luis_Mendes — Tue, 28 Feb 2017 04:46:00 GMT

The customer has a external portal with authenticate on gmail,microsoft and facebook. . The page of facebook not working... gmail and microsoft works fine, the customer review the script of page...The version of controller has upgraded to 10.21.02.0017

RE: L7 ROLE versio 10.21.01

Ronald_Dvorak — Tue, 28 Feb 2017 06:19:00 GMT

Works for me - bridge@EWC, V10.21.02, AP3705i, in my case I've blocked traffic as that was easier to test.

Note: it took some minutes before the traffic was blocked so I'm not sure whether I've done something wrong or whether there is some sync happening until it's active.

Have you enabled application visibility on the WLAN service ?

Back to the overall goal...I'm not sure whether I unterstand the setup..
the WLAN service is set to authentication for external captive portal and the screenshot show the unauthenticated traffic role ?
And then in case someone uses facebook, mail it should redirect to the portal and the user needs to authenticate on the portal ?

RE: L7 ROLE versio 10.21.01

Luis_Mendes — Tue, 28 Feb 2017 06:19:00 GMT

Yes, application visibility is enable.
The screenshot show unauthenticated traffic.
Yes, mail, or google redirect because this traffic pass...
On facebook customer will be review the config of facebook portal and i will update you...

RE: L7 ROLE versio 10.21.01

Alexandr_P — Tue, 28 Feb 2017 13:55:00 GMT

Hello, Luis!

What solution you use for external portal to authenticate using GMAIL, WINDOWS (OUTLOOK), OR FACEBOOK login to authenticate?

Can you share your solution?
It's just interesting you experience.

Thank you!

RE: L7 ROLE versio 10.21.01

Ronald_Dvorak — Tue, 28 Feb 2017 21:44:00 GMT

I've done ECP only with NAC but I think it's the same principle for internal/external which is you get only redirected to the portal if a deny rule is hit in the the unauthenticate role.

As a example take a look right here...
https://community.extremenetworks.com/extreme/topics/how-to-identifi-wireless-appliances-guest-porta...

If I unterstand that correctly that would mean that you'd need to deny mail, facebook so that clients get redirected to the portal if they use mail, facebook - right ?! *confused*