Can't select user groups in authentication mapping

[JohanHendrikx]

In the EAC you can configure the authentication rules in the AAA section. in one of those rules (Management Login) I want to configure an user group .

According to the help file ,should this be possible.

User/MAC/Host
Select the Pattern radio button and enter the username, MAC address, or hostname that the end-system must match for this mapping. Or, select the Group radio button and select a user group or end-system group from the drop-down list. If you enter a MAC address, you can use a colon (:) or a dash (-) as an address delimiter, but not a period (.).

The only groups I can select are End-System Groups.

How can I select an user groups ?

[JohanHendrikx]

Ryan, this works. Thanks for the solution

[Ryan_Yacobucci · Accepted solution]

The switch might be allowing you in just because the Access was "Accept". Can you change the "Denied Access NAC profile" and set it to "Reject authentication requests".

It will be the option at the top of the profile.

Thanks
-Ryan

[JohanHendrikx]

Results
Management login to switch 10.2.112.211. No Access granted for User: x326000, due to NAC Filter-Id: Enterasys:version=1:policy=Deny Access, Profile: Registration Denied Access NAC Profile Authentication Protocol: PAP, Request Attributes - Service-Type: 1, User-Name: x326000, Calling-Station-Id: 00-00-00-00-00-00, NAS-IP-Address: 10.2.112.211, OPENFLOW_DATAPATH_ID: 19706979330, NAS-Identifier: SW-A11, Called-Station-Id: 00-04-96-A0-A4-02, NAS-Port-Type: 5, NAS-Port: 0, Source-Address: 10.2.112.211 - Response Attributes - Filter-Id: Enterasys:version=1:policy=Deny Access - This is an administrative request because the MAC is zeros: 00-00-00-00-00-00, username is not null and no EAP-Message, MS-CHAP-Challenge or Tunnel-Client-Endpoint is present.

Management login to wireless controller 10.2.112.3. No Access granted for User: x326000, due to NAC Service-Type: null, Profile: Registration Denied Access NAC Profile Authentication Protocol: PAP, Request Attributes - Service-Type: 7, User-Name: x326000, NAS-IP-Address: 10.2.114.1, NAS-Identifier: EWC, NAS-Port-Type: 5, NAS-Port: 0, Source-Address: 10.2.112.3 - Response Attributes - Filter-Id: Enterasys:version=1:policy=Deny Access, Login-LAT-Port: 0 - This is an administrative request because the MAC is null, username is not null and no EAP-Message, MS-CHAP-Challenge or Tunnel-Client-Endpoint is present.

[Ryan_Yacobucci]

I"d have to take a look at the configuration.

If you look at the Alarms & Events --> Events --> Type of "NAC" or "Access Control Engine".

When you login to the switch and the controller take a look at those events. Did they hit the same rule?

Does the rule they hit indicate they were returned a "reject"?

Thanks
-Ryan