Extreme Control Rule and AD

[Ian_Broadway]

Hi All,

I am trying to create Extreme Control rule sets for MAC and .1x authentication.

Is there not a way I can add a group condition to query a LDAP/AD Domain group?

I can see there is an option for LDAP user groups.

Also, do Extreme offer some sort of downloadable config for updating DHCP fingerprints.

Its really tedious to have to go in and add lines of code to add custom fingerprints, not to mention having to hunt through a log file to get them in the first place.

One other thing, any ideas/thoughts on being able to add if/or conditions into the same rule?

Thanks

Ian

[Stefan_K_]

Hi Ian,

of course there is! 🙂

This user group is used in a NAC-Rule to allow the CLI-Access to network switches for the configured AD-Group (which is censored in the screen).

Can of course also used in combination with MAC and Dot1x Auth.

Edit: Dang, much too slow.

[Miguel-Angel_RO]

Ian,

1. Yes you can create a condition to trigger a rule based on an LDAP group
   1. https://gtacknowledge.extremenetworks.com/articles/How_To/How-To-Match-NAC-LDAP-Lookup-To-Active-Dir...
   2. https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-authorise-Windows-domain-user-compu...
   3. an others articles
2. I don’t know for the DHCP fingerprint tool
3. You can add if/or at different levels
   1. In the group definition

      1. 

      2. in the policy mappings (a Location Group lookup will trigger the return values)

Regards

Mig

[Ian_Broadway]

ok, just read 8.5 release notes, alot more functionality for DHCP fingerprinting.

other concerns still stand though if anyone has any thoughts please.