ā02-05-2021 01:21 PM
ā
Hi,
This Topic is a a follow up to
Although, I hopefully configured everything as advised and discussed in above thread,
Machine + User authentication fails. (Machine auth ONLY works fine, now!)
Below is a screenshot of the EvaluationTool result:
I donĀ“t see the mistakeā¦.
Solved! Go to Solution.
ā02-26-2021 10:35 AM
Dear all,
today customer tested the solution/correction and it worked.
Below my solution/explanation:
In an earlier mentioned documentation (https://extremeportal.force.com/ExtrArticleDetail?an=000080814) I primarily followed it was advised to use ācnā as Host Search Attibute (within the LDAP-configuration of āDomain usersā
At least in my environment, this did not work (as shown in above screenshots). The solution was to use ādNSHostNameā as Host Search Attibute (which is the default).
Changing this, the configuration worked. Machine AND User-Authentication are passed successfull.
Unfortunately, this solution is already described in https://extremeportal.force.com/ExtrArticleDetail?an=000082479 which I found during my troubleshooting.
In addition to this modification of the solution, I changed the advised order of the Rules.
Instead of
In my environment, Rule ā2ā never will be verified, after a Machine was successfully authenticated.
So, no user-authentication will ever happen.
For that reason, I switched the order of rule 1 and 2 and afterwards, all variations could be verified and authenticated.
Thanks all for your assistance.
ā02-12-2021 07:44 AM
Good morning all,
I“m quite desperate. I now have remote access and verified everything + also checked with the Eval-Tool + LDAP-Test-Feature.
Without success.
As shown in an earlier Screenshot, the Eval tool claims, that the Host āMV-xxx.deā does not have LDAP-attributes defined in the LDAP Host Group āEnd System Groups AD machinesā.
Verifying this with LDAP-Test : see below:
So, there IS such an entry.
What I am confused about: This entry is found as ādNSHostNameā.
According to ealier mentioned guide, āobjectcategoryā is defined as attribute for the group.
However, changing this to dnsNostName does not work either.
I checke configuration vs. guide several timesā¦..donĀ“t find the mistake.
Hope you can point out the issueā¦.
ā02-09-2021 04:00 PM
Stefan,
Are you meeting all the requirements for the LDAP groups?
See documentation:
Mig
ā02-09-2021 03:49 PM
Hello Stefan,
as I wrote above. If you have two rules with two different checks (is not and is), this is the point you have to investigate first.
In the LDAP test tool use the user search for rules matching an user and the host search for rules matching the host.
You can check which LDAP rule is used via the Eval tool (second tab = 2. Authentication evaluation).
As result you will receive the groups you user/device is in.
If you play arround with these settings you will have a good understanding what happen during the ldap checks in NAC.
ā02-09-2021 02:05 PM
Hello Stephan, Mig,
sorry for delay due to private reasons.
According to the documents and you assistance here we managed, that
TOP 1) āAuthenticate Windows CLIENT based on machine being in the AD.ā works.
TOP 2) does not yet work - as documented by my screenshots.
With regards to
As we have no remote access to the environment at the moment, I cannot test/verify again.
However, pls clearify what/how to test.
I have to verify once again
As soon as I have the result, i“ll post a screenshot.
Thanks + sorry for confusion, again
Stefan
ā02-05-2021 07:06 PM
That wasnāt my understandingā¦
SDR, It would be nice to clarify the exact use case and method you are trying to achieve.
Mig