NAC 802.1X Authentication and "Transparent" registration

[LeoP1]

Hi Guys,

I have a customer deploying NAC and they asked me for an "uncommon" feature...

The customer is willing to authenticate users (wireless) with NAC + AD using 802.1x, and want to control how much devices each user can "bring" into the network.

It's ok... I have deployed this kind of scenarios many times using the Authenticated Registration feature, but this customer doesn't want to have the users to, not even on the first access, to authenticate by 802.1x and authenticate again on the NAC Authenticated Registration Portal to have the device registered at the network.

In summary, as the user already authenticated by 802.1x, he wants the device to be "automatically registered" (and if the user already have reached the device limit, it gets denied, just like the portal).

Is there any way to do it?

Best regards,
-Leo

[Karthik_Mohando]

Hi Leo,

I would suggest to open up a GTAC case, in case if this does not exist they can assist in raising a feature request.

[LeoP1]

Hi Alex,

The customer is an University and they want zero-intervention on the students devices (nothing more than the OS (Android/iOS/Windows/MacOS) 802.1x user/password...

The captive portal redirection show issues sometimes depending on the user's device/config or gets "cucumbersome" for less experienced (sometimes lazy) users, and the customer doesn't want hundreds of calls to the helpdesk and/or the ombudsman complaining about "I Can't connect", "Your Network Sucks!" or even "In my home it works just fine, but here it sucks".

I don't think NAC have something like he is asking... Maybe using NAC Request Tool or other integration?

Best regards,
-Leo

[Eddgar_Rojas_Ca]

Well looks like is very common problem on Universities, I think the feature is not yet, as a university that have used that solution since Enterasys, we don't use 802.1x that is more secure for the same reason. Captive portals have the registration feature with time and device limiting and is pretty good but many random configs of devices, lazy people make this option harder to maintain, would be grate restrict by device and time also using 802.1x.

[Alexandr_P]

Hello!

May be you have to look to the PKI direction?
Like each client's device have to have own certificate, but not more then 3.

Because if we talking about device type and OS - it can be 2 same devices with same OS.
If we talking about MAC address - we can change it.

Thank you!