XIQ SE and Windows 11 Authentication EAP TLS

[Asifi]

Hello Community,

We have upgraded from Win 10 to Win 11 and are currently using EAP PEAP as the 802.1x authentication method.  I was told this would no longer work with Win 11 and we would need to implement EAP TLS.  I understand EAP TLS is not available for the version of XIQ SE we have - 23.4.12.3.

However, I believe later version of XIQ SE support EAP TLS.  If this is not the case please let me know. Could anyone let me know which minimum version of XIQ SE supports EAP TLS for XIQ SE and will I need a root certificate to be installed on XIQ SE and the NAC devices?

Is there a guide or similar I could use to Implement EAP TLS?

Currently, we use the built in 802.1x authentication via a LDAP server.  This I believe supports MsCHAP, PEAP and EAP-MsCHAPV2 only.

Many Thanks,

[Markus_Nikulski]

the pfx extension indicate is a PLCS12 formatted data. Yes it can be used to deploy the certificate for the Radius server.

[Asifi]

@Markus_Nikulski - Thanks Marcus, we use an LDAP server for user and machine authentication.  PFX still ok?

Thanks,

[Markus_Nikulski]

yes, it will work for group membership lookup. The user authentication is part of the offline certificate validation.

[Asifi]

@Bartek - we use an NPS to authenticate our Extreme AP users.  However, in this case I am talking about our end user devices so PC's/tablets/laptops etc.  Are you suggesting using NPS for the end devices too?

Thanks,

[Bartek]

I'm suggesting integrating Extreme Control with on-prem AD environment using RADIUS protocol for user authentication (it's called RADIUS Proxy mode) and LDAP for checking user access permissions:

SWITCH/AP <---> Extreme Control <----> NPS (RADIUS) + AD (LDAP)