Extreme Control Rule and AD

[Ian_Broadway]

Hi All,

I am trying to create Extreme Control rule sets for MAC and .1x authentication.

Is there not a way I can add a group condition to query a LDAP/AD Domain group?

I can see there is an option for LDAP user groups.

Also, do Extreme offer some sort of downloadable config for updating DHCP fingerprints.

Its really tedious to have to go in and add lines of code to add custom fingerprints, not to mention having to hunt through a log file to get them in the first place.

One other thing, any ideas/thoughts on being able to add if/or conditions into the same rule?

Thanks

Ian

[PeterK]

If Nested Groups are used then you need to add each nested group to the list and use mode “Match Any”. I saw a customer automated this task through API calls.

Of course, but this is only a dirty workaround and not a solution. I hope Extreme will support this in the future.

[Zdeněk_Pala]

If Nested Groups are used then you need to add each nested group to the list and use mode “Match Any”. I saw a customer automated this task through API calls.

[PeterK]

I think the problem of Ian ist, that Extreme Control does not support checking ldap attributes of nested group memberships.

You can only check ldap attributes where the account is direct assigned

[Zdeněk_Pala]

Hi,

for some rule components you have “OR” and “AND” already:

regarding the DHCP fingerprinting, here is a new GitHub repository. Feel free to contribute 🙂

[Ian_Broadway]

Thank you, i’ll ask the AD guys to check the account permissions for the account used for the LDAP config.