topic RE: Extreme Control Appliance as accounting proxy for sso in Security

Extreme Control Appliance as accounting proxy for sso

PeterK — Fri, 07 Dec 2018 19:53:00 GMT

Hello,

is it possible to use control appliance/engine as accounting proxy for sso on firewalls?

situation:
Control appliance/engine is set as radius & accounting server.
We like to forward accounting information to firewall for using SSO and authentication based policy on firewall.

Is this possible and is it possible without NMS ADV & Connect-API?

RE: Extreme Control Appliance as accounting proxy for sso

Brian_Anderson — Fri, 07 Dec 2018 23:45:00 GMT

What brand of firewall?

RE: Extreme Control Appliance as accounting proxy for sso

PeterK — Sat, 08 Dec 2018 00:04:00 GMT

I'd like to know in general, so the firewall brand is not so important.
In one special case it's Watchguard.

RE: Extreme Control Appliance as accounting proxy for sso

Brian_Anderson — Sat, 08 Dec 2018 00:25:00 GMT

I know it can be done on Fortigate and Palo Alto, but you need the Advanced version and be able to utilize the connect api.

RE: Extreme Control Appliance as accounting proxy for sso

Zdeněk_Pala — Sun, 09 Dec 2018 23:33:00 GMT

NMS-ADV is needed. You can use different modules to achieve this. the most generic one is for LightSpeed and you can use it for Sonicwall firewall and for CheckPoint also.

https://github.com/extremenetworks/Integrations/blob/master/README.md

RE: Extreme Control Appliance as accounting proxy for sso

PeterK — Mon, 15 Feb 2021 18:17:00 GMT

Do we have any updates here regarding sso forwarding?

Is it now possible to create "connect modules" yourself? If so, is there any documentation?

RE: Extreme Control Appliance as accounting proxy for sso

Zdeněk_Pala — Mon, 15 Feb 2021 22:20:00 GMT

Hi PeterK

Connect modules are delivered/developed/maintained by Extreme. You can create your own “middleware” that will use Connect or XMC through NBI.

RE: Extreme Control Appliance as accounting proxy for sso

PeterK — Mon, 15 Feb 2021 23:33:00 GMT

thank you.

Just to prevent a misunderstanding, there is no other way to send only radius accounting information to other radius servers or devices like firewalls?

In NAC AAA you can define uplink radius servers and enable “Proxy RADIUS Accounting Requests”

But from my understanding I can’t use this, when my local control-engines handle the complete authentication process, right?

RE: Extreme Control Appliance as accounting proxy for sso

Zdeněk_Pala — Mon, 15 Feb 2021 23:50:00 GMT

But “create connect module” and “send radius accounting” are two different questions… Thank you for request to clarification.

I am using “LightSpeed Systems” connect module to send radius accounting messages to 3rd party solutions. The module sends the info if both IP and Username is known.

Proxy Radius Accounting (Radius server settings) is used only if Proxy to upstream Radius server is used (AAA rules)