Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
‎08-06-2019 04:30 PM
I am deploying Extreme Control and have the user authenticating fine. I am looking to secure other devices such as phones and cameras. From what I have seen, an Active Directory object is created for each of these devices in order for authentication to be successful. Is this the case? Is there a better way to do it that does not involve me adding 1000s of AD user objects? These devices already have certs issued to them.
Any guidance is appreciated.
Thanks.
Any guidance is appreciated.
Thanks.
Solved! Go to Solution.
1 ACCEPTED SOLUTION
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
‎08-06-2019 05:25 PM
Hello,
An active directory object is not required for successful authentication when using EAP-TLS authentication.
When using EAP-TLS you set NAC to "Local Authentication" and install necessary RADIUS certificates and Trusted Authority certificates on the NAC itself.
NAC will provide it's RADIUS certificate to the client for validation, then the client will send it's certificate to the NAC for validation. As long as the AAA trusted authority certificate installed is the same certificate that signed the client certificate authentication will be successful.
There is no computer or user account necessary as EAP-TLS is not password based authentication.
The problem that you will run into is that without any AD objects it may become difficult to put these into authorization roles as since there are no AD objects we cannot utilize and AD technologies like security containters. LDAP lookups will not work if there are no objects in AD.
We can still use the CN of the certificate to provide an authorization though.
Thanks
-Ryan
An active directory object is not required for successful authentication when using EAP-TLS authentication.
When using EAP-TLS you set NAC to "Local Authentication" and install necessary RADIUS certificates and Trusted Authority certificates on the NAC itself.
NAC will provide it's RADIUS certificate to the client for validation, then the client will send it's certificate to the NAC for validation. As long as the AAA trusted authority certificate installed is the same certificate that signed the client certificate authentication will be successful.
There is no computer or user account necessary as EAP-TLS is not password based authentication.
The problem that you will run into is that without any AD objects it may become difficult to put these into authorization roles as since there are no AD objects we cannot utilize and AD technologies like security containters. LDAP lookups will not work if there are no objects in AD.
We can still use the CN of the certificate to provide an authorization though.
Thanks
-Ryan
6 REPLIES 6
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
‎01-22-2024 02:11 PM - edited ‎01-22-2024 02:12 PM
What exactly do you need, where do you have problems?
Local Auth and Trusted Authority Certs: AAA Config
Radius Certificates: Engine Configuration -> Certificates
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
‎08-06-2019 04:34 PM
I would create a rule for voip to prioritize traffic and put it on its own vlan. Phones really should be on their own vlan, and work well with Control to do that on the fly. I'm not sure why you'd want to go through all that effort. I would just put that traffic on its own vlan with its own authentication rules.
