ExtremeControl EAP Group Mappings, match on signing CA?

[Anonymous]

Hi,

As of 8.5.3 ExtremeControl has the ability to use multiple RADIUS certificates using EAP Group Mappings.

The determination of those certificates is done using EAP Group Mappings via the exchange of RADIUS packets to look at User-Name, NAS-IP-Address (Switch IP) or Calling-station-id (MAC Address), as per below:


You can then use a POSIX regular expression to find a match:


In my case there are two different certificate authorities, some clients will be signed by one, others will be signed by another. This is part of a migration to a new PKI. The issue here is that the only real distinction between client certificates presented to ExtremeControl will be the signing CA.

So the domain, user and NAS IP's in the RADIUS exchange are all going to be the same.

Is there a way to create a filter based on certificate signing CA, or something else I might be able to hook into to make the distinction?

Many thanks in advance.

[Anonymous]

Hi Mig,

Great, understood.

Thanks again.

Cheers,

Martin

[Miguel-Angel_RO]

Hi Martin,

The RADIUS will make a choice based on the commonName in the certificate.
If both PKIs are giving the same name, you'll not be able to discriminate on this parameter.
An alternative could be to present a public certificate (the CA Root should be in all the devices) during the migration and switch after that.
If the clients are windows devices, you can manage the authentication parameters via GPO and push both private Root CA.

Concerning the AAA, yes you ca upload both Root CA and the RADIUS will choose the one corresponding to the client certificate.

Regards
Mig

[James_A]

It should be possible to match on TLS-Client-Cert-Issuer https://extremeportal.force.com/ExtrArticleDetail?an=000064090

[Anonymous]

Hi Miguel,

Thank you posting a reply so quickly, and thank you for the added detail.

Also thank you for you patience if my understanding is incorrect.

So here is the scenario I am thinking of, which is based on computer authentication using EAPTLS. 

Two clients connect the same switch using a certificate with the same FQDN (due to migration), but have been signed by different PKI's.

Based on that information and the available RADIUS fields of Username (maybe just or PEAP) and NAS-IP address, these would be the same for each client, so what criteria could be used to make the distinction?

If each client has installed only the root and intermediates that belong to its own PKI, it becomes critical that the right NAC / RADIUS certificate is returned / presented to the client - hence back to what criteria to use?

In regards to AAA configuration, which is used to validate the client certificate / authentication, do you know if I can install root and intermediate certs for each of the PKI's in the same place?

That way the client certificate presented to NAC will be able to chain automatically against the right ones?

Many thanks,

Martin