XIQ SE and Windows 11 Authentication EAP TLS

[Asifi]

Hello Community,

We have upgraded from Win 10 to Win 11 and are currently using EAP PEAP as the 802.1x authentication method.  I was told this would no longer work with Win 11 and we would need to implement EAP TLS.  I understand EAP TLS is not available for the version of XIQ SE we have - 23.4.12.3.

However, I believe later version of XIQ SE support EAP TLS.  If this is not the case please let me know. Could anyone let me know which minimum version of XIQ SE supports EAP TLS for XIQ SE and will I need a root certificate to be installed on XIQ SE and the NAC devices?

Is there a guide or similar I could use to Implement EAP TLS?

Currently, we use the built in 802.1x authentication via a LDAP server.  This I believe supports MsCHAP, PEAP and EAP-MsCHAPV2 only.

Many Thanks,

[Markus_Nikulski]

yes, it will work for group membership lookup. The user authentication is part of the offline certificate validation.

[Asifi]

@Bartek - we use an NPS to authenticate our Extreme AP users.  However, in this case I am talking about our end user devices so PC's/tablets/laptops etc.  Are you suggesting using NPS for the end devices too?

Thanks,

[Bartek]

I'm suggesting integrating Extreme Control with on-prem AD environment using RADIUS protocol for user authentication (it's called RADIUS Proxy mode) and LDAP for checking user access permissions:

SWITCH/AP <---> Extreme Control <----> NPS (RADIUS) + AD (LDAP)

[Bartek]

Hi,

If you are working with AD environment, then I would recommend deploying at least one NPS server (o even two for redundancy) to handle RADIUS authentication with NAC and keep LDAP integration just for checking user attributes for applying correct network authorization.

NTLM protocol used by NAC for local RADIUS termination is somehow deprecated by Microsoft (https://learn.microsoft.com/en-us/windows/whats-new/deprecated-features)

[Markus_Nikulski]

we don't promote the NPS servie because we have XIQ-SE NAC scaling much better and have a enterprise great NAC solution.