NAC - 802.1x End-Systems IP missing, forward AAA

[tfsnetman]

Hello,

We have two Cisco WLCs 5500 using our Extreme NACs as Radius Authentication and Accounting servers.

• While Authentication works nicely, I am missing some IP addresses from End-Systems while others are there.
  • Any idea why?
• We would also like to forward the username / identity to a FortiGate firewall.
  • How would I do that?

Thank you,

Klaus

[tfsnetman]

Hi Stephan,

I guess, I will find out how well it works and let you know.

Any thoughts about how to forward user identity from the Extreme NACs to a FortiGate firewall?

Thank you,

Klaus

[StephanH]

If the WLC care about the DHCP forwarding add the NAC ip as DHCP server on the WLC.

[StephanH]

Hello Klaus,

the accounting settings should fit

 Regarding DHCP, I assume the DHCP server has no IP in the same network as your clients. Then there must be a router in your network that has a DHCP helper entry that contains the IP address of the DHCP server. Enter there also the NAC IP (additional), as if the NAC was a DHCP server.

[tfsnetman]

Hi guys,

Accounting Called Station ID type is set o IP and there is no option for both MAC and IP - see attachment.

We are talking about Wi-Fi and 802.1x authentication only where IP addresses are always assigned via DHCP.

@Stephan: not sure whether what you mean by registering NACs as a DHCP server and how those DHCP requests would flow.

Thank you,

Klaus

[StephanH]

Switching on WLC accounting is not always sufficient depending on the sw version. To be sure you have to check if the transmission of MAC and IP under

Acct Called Station ID Type

is switched on. But guessing helps little here, it would be good to know how the address resolution runs in the installation Klaus mentioned.