Flexible SSID (Multiple Active Directory)

[Thiago_Almeida]

Hi all,

Is it possible to have a single SSID for two separated Active Directory domains?

Our customer have two different domains, with separated ADs and different vlans.

Can we configure the Enterasys controller to use only one SSID and authenticate user on both domains and leading them to the correct VLAN for their domain?

Thanks and regards,

TA

[hsachse]

I agree Doug. A requirement for the RADIUS server is that both ADs are in the same forest.

[Doug]

The RADIUS server you point to from the controller has to be able to reach both AD servers for username/password validation. If the RADIUS server cannot reach both then this will not work (based on my knowledge).

[hsachse]

Another idea would be to setup 2 RADIUS servers (one in every domain) and using RADIUS proxies rules to path RADIUS request for CORP1.CORP to the RADIUS server of domain CORP2.CORP and vice versa. Communication between the RADIUS servers must be possible.

To decide which requests should handeld locally and which passed to the other RADIUS server You must use usernames and realms (the idea is used by eduroam for world wide roaming between wireless infrastructures). This usernames look like an mail address for example user@corp1.com or user@corp2.com. Try searching for "configure NPS radius" to find some examples.

[Thiago_Almeida]

Hi Doug,

Thanks for your reply.

I watched your video but from what I understand is that the two groups are on the same AD database.

Can I do the same type of configuration but using two different ADs instead of groups?

Like CORP1.CORP domain on vlan 101 and CORP2.CORP domain on vlan 102 with ssid CORP.

When a user tries to connect to CORP ssid the RADIUS would check by its existence on both domains?

If its a CORP1.CORP domain user it would be assigned an IP on the vlan 101 subnet?

They need this because they bought another company and their merging offices but networks must remain logically independent, using same physical network components (switches, controllers, APs) bur different resources, services, servers.

Replying your answer, I do not know if its a VM so we can have the RADIUS on both VLANS, but if not, is it possible to use two different RADIUS to achieve this configuration? One on each domain/vlan?

Thanks and regards,

TA

[Doug]

Are both domains accessible from the RADIUS server?

Typically this can be done based on the NPS policy rule hit. Here is an example configuration for two different groups, one SSID...

http://youtu.be/F2psltLUA-c?list=PL0E4DD34E0CB786A5