Local Administrator account and Extreme NAC

[ExtremeNewbie]

Hello Community,

Apologies if this question is in the wrong section.

We are using XMC- SE and NAC control in our environment.  We are currently testing User and Machine Authentication via Certificates.  The User and Machine are domain joined and can authenticate as expected.

However, I am finding I cannot authenticate an end user device when I login with a local administrator account.  This makes sense as the settings are setup to use domain joined authentication.

My question is, can local administrator accounts on end user devices somehow be authenticated to give network access?  When I login with the local administrator account, the network drops off after a short time.  In XMC I can see for the local administrator account the message "Rejected NTLM Authentication".

Many thanks,

[Ryan_Yacobucci]

Hello,

If you follow the guide I provided above, but instead of an "LDAP User Group" use a "Username" user group and define the users you want to login. 

[ExtremeNewbie]

@Ryan_Yacobucci I have created the local user as per instructions please see below.

I have created a new AAA Rule for this and placed this at the top of the list - please see below.

I have created a new Rule for this as described - see below.

Profile is below.

Then the Reject Rule - this is what I am unsure about.  I have set this to Reject Authentication Requests - see below.

In total, it looks like this - see below.

I believe this is all that is needed from the AAA and Rule side.  Please correct me if I am wrong. 

If all the above is correct, the next step is to configure the switch in the NAC Engine to accept Any Access?  Will this then accept Radius and the new AAA/Rule created above?  The new Rule is not enabled at the moment as I have not completed the NAC side yet.

Many Thanks,

[Ryan_Yacobucci]

Hello,

This looks pretty good to me. 

Authentication is configured to handle the local users by the local password repository. 

Authorization is configured to send back an administrative response if it's an authorized user, and ANY other management logins will be rejected.

Some final considerations: 

1. When you add the switch you have to set the Auth Access type to "Any Access". This will have Control attempt to configure the device to send RADIUS requests for management access. As long as the device supports dynamic RADIUS configuration, when you enforce the NAC, NAC will reconfigure RADIUS to enable for the management realm/facility. 

Once you enforce, make sure the configuration is changed accordingly. 

2. When you add the switch, make sure the "RADIUS attributes to send" contains the necessary attributes for management access. 

Service-Type for EXOS
Service-Type or Passport-Access-Priority for VOSS depending on version
Service-Type for XIQ-C

Typically Service-Type=6 will get you read/write access.

[ExtremeNewbie]

@Ryan_Yacobucci - many thanks for checking and confirming the setup.  I will look at the switch side shortly.  One other item from me, when adding a username to the user group, does a wildcard for example .\name work for this?

Kind regards,