topic Re: EAP Authentication of AP 3XX 4XX 5XX connected to XCA XCC in Extreme Cloud

EAP Authentication of AP 3XX 4XX 5XX connected to XCA XCC

PeterK — Thu, 23 Jul 2020 15:06:12 GMT

Hi,

currently it’s not possible to push a 802.1X Config to APs from XCA / XCC as it works on identifi for years.

Is it possible to do a EAP-PEAP or EAP-TLS Config (maybe via cli/ssh/scp) on Wing 7 APs, when running centalized mode?

Re: EAP Authentication of AP 3XX 4XX 5XX connected to XCA XCC

SantM — Thu, 23 Jul 2020 16:07:23 GMT

Hi Peter,

I don’t think that is possible. 802.1X authentication seems to be completely dependent on XCA/XCC. I had long discussion with GTAC and SE on it. I hope that I am wrong at it. 🙂

Even in distributed mode, 802.1X seems to be dependent on XCA. As far as I remember, if we look configuration on wing APs in distributed mode, AP will have IP address of XCA as radius server, not the IP addresses of radius servers, we configure on XCA.

BR;

Santosh

Re: EAP Authentication of AP 3XX 4XX 5XX connected to XCA XCC

PeterK — Thu, 23 Jul 2020 16:31:33 GMT

Hi Santosh,

I never tried distributed mode of XCA.

I will not run XCA / XCC as radius/nac.

I’m having a NAC / Extreme Control for authentication.

I will authenticate the APs via EAP and not only via MAC.

Extreme announces XCA / XCC as follow up product for identifi. But currently it’s unusable in enterprise enviroments because a lot function are still missing, which were available on identifi since years.

Re: EAP Authentication of AP 3XX 4XX 5XX connected to XCA XCC

Tomasz — Thu, 23 Jul 2020 17:27:46 GMT

Hi Peter,

As far as I understand, “WiNG 7” APs ie. 3xx/4xx/5xx are dual-mode APs. In distributed mode (when they find WiNG controller or VC or XCA/XCC at which they belong to a distributed site*) they are booting with WiNG software. In centralized mode (when they find XCA/XCC at which they belong to a centralized site), they are booting IdentiFi software. This will determine what you can achieve through CLI of an AP itself.

* - there was something happening with Distributed Site support on XCA/XCC 4.76.01/4.76.02:

Hope that helps,

Tomasz

Re: EAP Authentication of AP 3XX 4XX 5XX connected to XCA XCC

PeterK — Thu, 23 Jul 2020 17:49:08 GMT

Hi Tomasz,

right.

I’ve never done this via CLI / Filetransfer on native identifi APs. I always used the controllers web gui for EAP config on the native identifi APs.

So, I dont’t if and maybe how it was possible that I could try this on a Wing 7 AP in centralized mode.

Re: EAP Authentication of AP 3XX 4XX 5XX connected to XCA XCC

PeterK — Thu, 23 Jul 2020 21:47:19 GMT

missing word:

So, I dont’t know if and maybe how it was possible that I could try this on a Wing 7 AP in centralized mode.

@Ronald Dvorak

do you have a idea?

Re: EAP Authentication of AP 3XX 4XX 5XX connected to XCA XCC

Ronald_Dvorak — Fri, 24 Jul 2020 02:41:43 GMT

Sorry but I gave up on WiNG.

If someone tells me that I’d need the CLI to config a WLAN installation then something is wrong with the product IMHO.

ECA is also not for me - as you’ve mentioned it should replace Identify but but there are sooo many features missing.

I think we’d all agree that CloudIQ is the future and the rest is…..

-Ron

Re: EAP Authentication of AP 3XX 4XX 5XX connected to XCA XCC

Tomasz — Fri, 24 Jul 2020 02:58:10 GMT

Peter, Ron,

“WiNG 7 AP” 3xx/4xx/5xx could rather be referred as “Dual-Mode APs”. In centralized mode it is simply IdentiFi-loaded box. Whatever you want to do on that and it’s not available in XCA/XCC GUI, you have to deep dive in IdentiFi CLI and give a try… I don’t have one by my side right now but from some old dump I see you may want to check ‘cset peapPassword’ and ‘cset peapUsername’, hoping it’s the same since 37XXs. Then capply, csave and a reboot for good health. I’ll be able to play around somewhere next week, finally getting some fresh lab equipment (and a new slim tiny server to assemble, yaay).

Personally I’m stubbornly waiting for new GUI of WiNG (hoping they gonna get inspired by XIQ), as feature set and configuration scheme impresses me at most, once I gave it a chance after years on IdentiFi. IMHO XIQ look & feel is awesome, amount of troubleshooting tools as well (on WiNG collecting station-related events from entire site is good, OTOH on XIQ APs even LDAP test is available, and spectrum analysis is so much better). I hope to see a platform that takes all good from both…

Hope that helps,

Tomasz

P.S. CLI is cool for assigning static channels on many APs at once by pasting a ready-to-go code into Putty. 😛

Re: EAP Authentication of AP 3XX 4XX 5XX connected to XCA XCC

Miguel-Angel_RO — Sat, 25 Jul 2020 23:36:35 GMT

Hi Peter,

I used this CLI code to enable the 802.1X PEAP per AP.

Playing with excel you can generate a lot of configs easily based on a list of serials.

As a reminder the 802.1x config in Identify is to be done per AP, so I always did that via CLI to configure it and certainly on big installations (1000+ APs).

As Tomasz mention it, it is a part of a bigger CLI config where I also fix the channels and the output power.

##########
ap
18xxy-1xxxx00000
802_1x
peap username_used P@5sW0rD
exit
apply
exit
18xxy-1xxxx00000
...
##########

Re: EAP Authentication of AP 3XX 4XX 5XX connected to XCA XCC

PeterK — Mon, 27 Jul 2020 19:36:49 GMT

Thanks, for all your Information.

It works.

You can send PEAP credential via AP-CLI oder via XCA-CLI to the AP.

I makes no difference if its a native identifi ap or a wing7 ap in centralized mode.

Re: EAP Authentication of AP 3XX 4XX 5XX connected to XCA XCC

Miguel-Angel_RO — Thu, 22 Oct 2020 14:16:58 GMT

Hi Peter,

The option is now available on XCC 5.16.01 as option Site/DeviceGroup/Profile/ADVANCED:

Regards

Mig