Extreme Networks

Ian_Broadway · ‎09-29-2020

Hi All,

I am trying to create Extreme Control rule sets for MAC and .1x authentication.

Is there not a way I can add a group condition to query a LDAP/AD Domain group?

I can see there is an option for LDAP user groups.

Also, do Extreme offer some sort of downloadable config for updating DHCP fingerprints.

Its really tedious to have to go in and add lines of code to add custom fingerprints, not to mention having to hunt through a log file to get them in the first place.

One other thing, any ideas/thoughts on being able to add if/or conditions into the same rule?

Thanks

Ian

Miguel-Angel_RO · ‎10-13-2020

Stefan,

With a script from @Zdenek Pala (https://github.com/extremenetworks/ExtremeScripting/blob/master/Netsight/oneview_workflows/combo/Use... you can mix both authentications to ensure that the user authentication is done on a computer from the domain:

"Add MAC to Domain Computers" is executed when the computer authenticates. The MAC address is added to End-System and the timestamp is created (updated). Consequent User authentication can be combined with the condition of the End-System group. "Clear old End-Systems in the group" checks if the timestamp is older than X hours and old End-Systems are deleted from the group.

Mig

View solution in original post

Ian_Broadway · ‎10-12-2020

01ab95e6a53246d1a28a87a28686ef25_1f18a737-da11-431c-8012-025fe3fb9bef.png

Miguel-Angel_RO · ‎10-12-2020

The LDAP config you use for the host

Ian_Broadway · ‎10-12-2020

Yep using the test function, what config do you want to see?

Miguel-Angel_RO · ‎10-12-2020

Ian,

Do you test with the test button on the LDAP config screen?

ccfa7a10e6e1408ea645d49e6acfda7d_4e1dddc4-e774-43f2-b99b-f594307dc1eb.png

Could you share your config with a screen shot?

Mig

Ian_Broadway · ‎10-12-2020

ok, so back on topic, as a test, the account used to join the EAC appliances to the domain/used in the ldap configuration was given full domain admin rights.

When testing it still couldnt see the host device return the memberof attribute for the “domain computers” group. it worked for all other member groups as mentioned in an earlier host.

any ideas?

Extreme Networks

Extreme Control Rule and AD

Extreme Control Rule and AD