Extreme Control Machine + User authentication fails

[SDR]

​
Hi,

This Topic is a a follow up to

Although, I hopefully configured everything as advised and discussed in above thread,   

Machine + User authentication fails. (Machine auth ONLY works fine, now!)

Below is a screenshot of  the EvaluationTool result:

I don´t see the mistake….

[StephanH]

Hello SDR, hello Mig,

I'm a little confused. What are you trying to implement SDR? Based on your ruleset, I assumed you were using the procedure described here:

https://extremeportal.force.com/ExtrArticleDetail?an=000080814&q=nuc%20802.1x%20ldap%20user%20&_ga=2...

[Miguel-Angel_RO]

Hi SDR,

Looking at those screens I see:

1. From the rules: “Machine and User Auth” is expecting “End-Systems Groups AD machines”
2. From the evaluation tool: “Th Host ...doesn’t have LDAP attributes..in this inclusive LDAP Host Group End-Systems Groups AD machines”

Looking at the the description of the workflows and scripts from Zdenek we see:

"Add MAC to Domain Computers" is executed when the computer authenticates. The MAC address is added to End-System and the timestamp is created (updated). Consequent User authentication can be combined with the condition of the End-System group. "Clear old End-Systems in the group" checks if the timestamp is older than X hours and old End-Systems are deleted from the group.

From the script description, it means that the HOST (read “End-System”) is to be looked into a group of MAC adresses while you defined and LDAP group in the rule for the statement “End-System is in”.

To make it shorter, you’ll store (for a defined period of time) all the MAC addresses from the AD computers (having been authenticated) in a group and check if the authenticating user is with a computer having his MAC in this group.

I know that the way this script works is not very intuitive (looking for a MAC to see if a computer belongs to an AD domain) but there are some technical constrains on the authentication steps that implies this solution.

Mig

[StephanH]

Hello SDR,

your maschine is matching IS NOT in End-System Groups AD machine

and is not matching IS in End-System Groups AD machine

=> Are you 100% sure that the maschine is in the expacted AD group?

That’s why I ask if you can see if the client is in the group (with the LDAP test tool)

[SDR]

See below - as we are still testing, we did not focus on the “actions” (profiles)

[SDR]

We already did and to my understanding, the tests were sucessfull.