NAC - 802.1x End-Systems IP missing, forward AAA

[tfsnetman]

Hello,

We have two Cisco WLCs 5500 using our Extreme NACs as Radius Authentication and Accounting servers.

• While Authentication works nicely, I am missing some IP addresses from End-Systems while others are there.
  • Any idea why?
• We would also like to forward the username / identity to a FortiGate firewall.
  • How would I do that?

Thank you,

Klaus

[tfsnetman]

Thank you Stephan,

Added the NACs as a secondary DHCP server on all WLC interfaces which increased the accuracy for MAC IP address resolution.

Since both the NACs and the DHCP server are in the same subnet I would have expected this to work based on DHCP multicast messages alone.

I was also able to use the FortiGate SSO module in the XMC Connect which is now forwarding Radius accounting information. The sender IP of the Radius data is the XMC and not the NAC.

All the best,

Klaus

[StephanH]

Hello Klaus,

because of the additional information you metioned, you know your helper setting is correct.

To see what's goung wrong with your ip resolution, follow that guide for debugging and check the output in the log file:

https://extremeportal.force.com/ExtrArticleDetail?an=000082183&q=mac%20to%20ip%20resolution%20failed

[tfsnetman]

Hi Stephan,

Adding the Extreme NACs as a secondary DHCP on the Cisco WLCs is providing additional information such as Device Type and hostname but doesn’t help with further IP addresses.

Thank you for pointing me to the manual. I will have my black belt / PhD in XMC, Control after applying that knowledge.

Cheers, Klaus

[StephanH · Accepted solution]

Hello Klaus,

maybe the ExtremeConnect integration for FortiGate is what you need. Check the manual here:

https://documentation.extremenetworks.com/netsight/8.5/XMC_8.5_ExtremeConnect_User_Guide.pdf?_ga=2.2...

If you need other information in you Fortigate. Maybe the XMC NBI-API can help you.