This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Extreme Networks
- Community List
- Network Management & Authentication
- ExtremeCloud IQ- Site Engine Management Center
- Re: 802.1x user authentication and Machine authent...
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
802.1x user authentication and Machine authentication via certificate
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
05-31-2019 12:39 PM
Hi All
I have configured a wifi SSID to autenticate user via 802.1x user credential by LDAP Microsoft, using a NAC appliance, where I have configured the below rule, that match a specific LDAP user group, and a specific SSID.
I need to authenticate user & machine in the same time, user via LADP credential and machine via certificate.
Someone could help me?
I have configured a wifi SSID to autenticate user via 802.1x user credential by LDAP Microsoft, using a NAC appliance, where I have configured the below rule, that match a specific LDAP user group, and a specific SSID.
I need to authenticate user & machine in the same time, user via LADP credential and machine via certificate.
Someone could help me?
Solved! Go to Solution.
1 ACCEPTED SOLUTION
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
08-11-2021 08:31 AM
Hi Tomasz,
Thank you for your reply. I was talking about the EAP-TEAP with a vendor of our Extreme solutions. They contacted Extreme directly and found out that Extreme NAC does not support EAP-TEAP yet. However, it’s in their road map so hopefully someday…
Nevertheless, there should be basically two workarounds. The first one is the one you’re describing in your previous post. I can be done either manually or using the workflow you provided.
The second one is to create two rules. First for machine certificate authentication and second one for identity authentication (credentials in AD). For this option you need to set your Windows supplicant for EAP-TEAP authentication, but I was told, that it does not work very well. However, I haven’t tried it myself, so who knows, it may be the way.
I’m not an expert in AD/GPO myself, but I don’t believe that there is a “user-friendly” solution. And even if it was, I would like to assign different VLANs to different groups of users, which wouldn’t be possible, right? The NAC would just let the machine to the network, but I’d have to have a user certificate (which I don’t have) to assign a specific VLAN. With machine certificate only, the NAC would know that the machine is from our company, therefore let it in, but wouldn’t know which user uses it, so I can’t create any user group.
Regards,
Jakub
12 REPLIES 12
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
06-07-2019 07:50 AM
Thanks a lot to All
Anonymous
Not applicable
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
06-03-2019 09:50 AM
I would be interested in a supplicant also, as I've have customers that want certificate authentication for machines (EAP-TLS) and straight user login (PEAP) when logging in - although that isn't necessary, and a lot more secure and standards based to use certificates for both - no need for a custom / propitiatory supplicant then.
Although you can't do both at the same time, think I'm right in saying you can use both machine and user authentication in the manner requested, you just basically authenticate twice.
When the laptop connects to the network it will initially do machine based authentication, then when logging in it will then do user authentication - this is how I've configured it in the past.
This is based on using certificate base EAP-TLS authentication in both cases, so the supplicant doesn't need to change between different methods i.e. you can just use the windows native supplicant.
In both cases you can use LDAP to validate the authorisation allowed. The advantage to also doing user certificate based authentication (simplicity, security, and standards based aside) is that you can elevate policy roles based on the user logged in, whereas machine authentication is just based on the machine.
You can configure the windows client to log on first to initially pull down the client certificate to end-system so its portable whenever you log into any end-system that doesn't already have a user certificate in its local repository.
Hope that helps?
Although you can't do both at the same time, think I'm right in saying you can use both machine and user authentication in the manner requested, you just basically authenticate twice.
When the laptop connects to the network it will initially do machine based authentication, then when logging in it will then do user authentication - this is how I've configured it in the past.
This is based on using certificate base EAP-TLS authentication in both cases, so the supplicant doesn't need to change between different methods i.e. you can just use the windows native supplicant.
In both cases you can use LDAP to validate the authorisation allowed. The advantage to also doing user certificate based authentication (simplicity, security, and standards based aside) is that you can elevate policy roles based on the user logged in, whereas machine authentication is just based on the machine.
You can configure the windows client to log on first to initially pull down the client certificate to end-system so its portable whenever you log into any end-system that doesn't already have a user certificate in its local repository.
Hope that helps?
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
06-01-2019 05:53 PM
Hi Claudio,
If you want to do user + machine authentication, native MS Windows supplicant will not allow you to do this as for now (only user OR machine authentication). This thing what you want is sometimes referred as EAP Chaining. It is reachable with 3rd party supplicant software like https://github.com/Amebis/GEANTLink (but mentioned as experimental). I'm not sure but maybe SecureW2 also enables devices for that. Maybe there are some others, of course besides Cisco's proprietary supplicant. 😉
I'm also curious if somebody here has some field-proven supplicant software example for this.
Hope that helps,
Tomasz
If you want to do user + machine authentication, native MS Windows supplicant will not allow you to do this as for now (only user OR machine authentication). This thing what you want is sometimes referred as EAP Chaining. It is reachable with 3rd party supplicant software like https://github.com/Amebis/GEANTLink (but mentioned as experimental). I'm not sure but maybe SecureW2 also enables devices for that. Maybe there are some others, of course besides Cisco's proprietary supplicant. 😉
I'm also curious if somebody here has some field-proven supplicant software example for this.
Hope that helps,
Tomasz
