Extreme Control Rule and AD

[Ian_Broadway]

Hi All,

I am trying to create Extreme Control rule sets for MAC and .1x authentication.

Is there not a way I can add a group condition to query a LDAP/AD Domain group?

I can see there is an option for LDAP user groups.

Also, do Extreme offer some sort of downloadable config for updating DHCP fingerprints.

Its really tedious to have to go in and add lines of code to add custom fingerprints, not to mention having to hunt through a log file to get them in the first place.

One other thing, any ideas/thoughts on being able to add if/or conditions into the same rule?

Thanks

Ian

[SDR]

Hi Mig,

it WAS the server certificate validation in the windows client.

Thanks for this hint.

So, now, the machine successfully authenticates with NAC.

According to the documents linked above, there should be an additional authentication, when an AD user logs in.

But this does not work. We configured everything from scratch this morning. After the machine has be authenticated successfully, no further authentication takes place, when the user logs in the client.

😞

[Miguel-Angel_RO]

Hi SDR,

This seems to be the server certificate validation in the windows client.

In the 802.1X parameters on the Windows PC can you disable the server certificate validation?

The alternative is to add the root certificate corresponding to the radius certificate to the windows client.

Also ensure to perform only computer authentication, the default is user.computer authentication.

Regards

Mig

[SDR]

Hi all,

Unfortunately I can only make photos, no screenshots (not my client).

See below.

TESTING the “username = host/….” within the LDAP-configurator test-function and the Config-Eval-Toole is successful, however.

[SDR]

OK - so we don´t have to worry about the “username” anymore.

Regards the Rule: That´s how we configure it.

Rule Authentication “802.1x” (not with “(PEAP)” - I assume that we use the superior level this way” ,

validating the existance of “user” in the endsystems-group (configured and tested according the documentation Peter advised me, using Profile “assign my vlan”….

[Miguel-Angel_RO]

SDR,

That’s normal.

You do a “computer authentication” but the computer is doing an authentication with his own “username”.

The username and password are from the AD computer account.

The rules you are going to build must take this into account. You must match a “username” for a computer.

Here an example from a running system:

Mig