Hi everyone,
I would like to ask if anyone has experienced a similar issue while working with ExtremeControl.
Our customer has the following environment:
- 2 × ExtremeControl Engines
- 1 × ExtremeCloud IQ Site Engine
- 2 × Wireless LAN Controllers (WLCs)
- Active Directory used as the authentication source
- 802.1X authentication (PEAP/MSCHAPv2)
- Dynamic VLAN assignment after successful authentication
The authentication workflow is the following:
Client
│
│ Connects to SSID (802.1X)
▼
Wireless AP
│
▼
WLC
│
▼
ExtremeControl (ACE)
│
│ RADIUS Authentication
▼
Active Directory
│
│ User authenticated
▼
ExtremeControl returns VLAN
│
▼
Endpoint receives VLAN and network access
The issue
At the customer's request, they modified the user's Active Directory account.
In:
Active Directory Users and Computers
→ User Properties
→ Account
→ Log On To...
Instead of allowing the user to log on to all computers, they restricted the account to only one specific computer.
After applying this change, the user is no longer able to authenticate through the 802.1X wireless SSID.
My questions
- Has anyone encountered this behavior before?
- Does ExtremeControl (or Windows NPS/LDAP authentication) validate the Log On To restriction during 802.1X authentication?
- Is this expected behavior from Active Directory?
- Is there any recommended approach if the customer wants to restrict interactive Windows logons without affecting wireless 802.1X authentication?
Any insights or best practices would be greatly appreciated.
