topic RE: WLAN 802.1x PEAP Authentication should work with first device only in Network Architecture & Design

WLAN 802.1x PEAP Authentication should work with first device only

M_Nees — Wed, 04 Feb 2015 16:40:00 GMT

Is it possible the restrict and limit an sucessfull 802.1x PEAP (Username / Password) Authentication to the first device only within NAC Gateway?

During several customer projects such a feature would be very useful.

Regards

RE: WLAN 802.1x PEAP Authentication should work with first device only

Ronald_Dvorak — Wed, 04 Feb 2015 16:55:00 GMT

Do you mean one concurrent active client with this username/password or the first client that ever uses that username/password....

RE: WLAN 802.1x PEAP Authentication should work with first device only

M_Nees — Wed, 04 Feb 2015 16:59:00 GMT

Both szenarios are valid - if i have to choose between the two - one concurrent active client would more repesent customers needs.

RE: WLAN 802.1x PEAP Authentication should work with first device only

M_Nees — Wed, 11 Feb 2015 18:14:00 GMT

does nobody have a solution or maybe same requirements ?

i have several customer projects where this is a needed feature. But my recent state is that NAC Gateway have no feature that makes this possible.

If someone have same requirements, please post this! I hope if more customers requested this possibility enterasys/extreme will think about implementing this ...

RE: WLAN 802.1x PEAP Authentication should work with first device only

Brian_Anderson3 — Thu, 12 Feb 2015 00:58:00 GMT

You could do a Authenticated Registration portal, but it wouldn't be a .1x ssid. But you could limit the user to have only one device registered.

RE: WLAN 802.1x PEAP Authentication should work with first device only

Michael_Kirchne — Sat, 07 Mar 2015 21:49:00 GMT

Same request from me

RE: WLAN 802.1x PEAP Authentication should work with first device only

Tony_Dann — Fri, 08 May 2015 08:12:00 GMT

This is something we are needing, working in education we need to be able to limit kids to one device.

RE: WLAN 802.1x PEAP Authentication should work with first device only

Ronald_Dvorak — Mon, 19 Jun 2017 15:51:00 GMT

Any update on this "function" ?

As far as my Google skills go I'm not able to find a solution for it using either ExtremeControl or Windows NPS.

RE: WLAN 802.1x PEAP Authentication should work with first device only

M_Nees — Tue, 20 Jun 2017 11:10:00 GMT

feature is still needed ....

RE: WLAN 802.1x PEAP Authentication should work with first device only

Drew_C — Mon, 03 Jul 2017 23:46:00 GMT

I'll send this thread along to PLM for them to work on the feature request.

RE: WLAN 802.1x PEAP Authentication should work with first device only

M_Nees — Mon, 03 Jul 2017 23:46:00 GMT

Any feedback ?

RE: WLAN 802.1x PEAP Authentication should work with first device only

Matthew_Hum — Wed, 12 Jul 2017 12:11:00 GMT

You can accomplish this by chaining FreeRADIUS servers. NAC would then send to an upstream FreeRADIUS server that uses the perl_rlm module to run a call back to the NAC DB to query for existing entries to then deny or proxy the RADIUS request.
If you are using a local DB, then enable the simultaneous-use variable and set it to 1, for only one system at a time. I believe you will need radius-accounting for this to work as well.

Edit: This was originally written for wired, and I have removed the wired portion as it would not work for wireless.

RE: WLAN 802.1x PEAP Authentication should work with first device only

M_Nees — Wed, 12 Jul 2017 12:11:00 GMT

Cool solution (but not useable normal customer environment)!

How many time do you spend to write/configure the perl_rlm module ? How do you realize the NAC DB query ?

Regards,
Matthias

RE: WLAN 802.1x PEAP Authentication should work with first device only

Matthew_Hum — Wed, 12 Jul 2017 12:11:00 GMT

I don't see why it wouldn't be usable in a customer environment.

it can't take that long. maybe an hour or two? depends on how good you are I guess. you can use the NAC API for the query.

RE: WLAN 802.1x PEAP Authentication should work with first device only

Chacko — Thu, 19 Oct 2017 19:10:00 GMT

Hi Matthias,

stupid question:
Wouldn't your requirement be satisfied with "configure netlogin ports X allowed-users "?
Or did i misunderstand your need?

Best Regards
Chacko

RE: WLAN 802.1x PEAP Authentication should work with first device only

M_Nees — Thu, 19 Oct 2017 19:10:00 GMT

Sometimes i have several clients on one port (= desktop switch). What i avoid is that a user is using his own username + pw (of windows) several times for several devices.

Limiting the number of clients per switch port has therefore negative effects and do not address my concern directly.

Regards