Extreme Control Rule and AD

[Ian_Broadway]

Hi All,

I am trying to create Extreme Control rule sets for MAC and .1x authentication.

Is there not a way I can add a group condition to query a LDAP/AD Domain group?

I can see there is an option for LDAP user groups.

Also, do Extreme offer some sort of downloadable config for updating DHCP fingerprints.

Its really tedious to have to go in and add lines of code to add custom fingerprints, not to mention having to hunt through a log file to get them in the first place.

One other thing, any ideas/thoughts on being able to add if/or conditions into the same rule?

Thanks

Ian

[Ian_Broadway]

thats fine but the issue is the manual process of adding fingerprints.

some things on the Medical subnet might not be classed as a medical device based on the default fingerprints, hence the reason to reference the multiple conditions in a rule.

would be ideal if the invert option was alongside an or and an and statement.

[Miguel-Angel_RO]

Ian,

A workaround could be to define a new devicegroup including all the fingerprints you are looking for and match this group.

Mig

[Ian_Broadway]

So is there a way you can make the conditions in a rule be or conditions?

At the moment any conditions in the rule all have to be matched?

For example I have a rule for Medical devices. I would like it so that if Fingerprinting determines its  “medical device” it will hit this rule or if its part of a certain vlan/subnet to which I know for a fact is solely for medical devices

or do i have to have multiple rules to be able to capture this behaviour?

[Ian_Broadway]

Yep looks like it could well be an account issue as getting this error on the Appliance

2020-10-01 15:58:41,919 ERROR [com.enterasys.tesNb.server.freeradius.files.SambaInstallationManager] (EnforceHandler - Off Thread Notify Listeners0:) Failed to join domain: "removed" for user: "removed" with error code: 255
        ADS join did not work, falling back to RPC...
        Failed to join domain: User specified does not have administrator privileges
        Failed to join domain: failed to find DC for domain “removed” - {Operation Failed} The requested operation was unsuccessful.
 

[Ian_Broadway]

Its not a nested group actually but if im honest anything that makes the integration better is a win for sure, its a global security group that sits in an OU along with other security groups. It does not belong to other groups.

Its the group all domain joined PCs/Laptops become a member of when joined to the domain.

the other groups i referenced above are also part of the same OU yet the host only reports the memberOf attributes of the other two groups, not the domain computers one. 

Still waiting on the permissions check with the account used in the LDAP config.

Will let you know if this solves it.