This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Accept
Reject
Help
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 

Guidance in securing IP Phones and cameras with Extreme Control EAP-TLS

Guidance in securing IP Phones and cameras with Extreme Control EAP-TLS

Go to solution
Jay2009
New Contributor

‎08-06-2019 04:30 PM

I am deploying Extreme Control and have the user authenticating fine. I am looking to secure other devices such as phones and cameras. From what I have seen, an Active Directory object is created for each of these devices in order for authentication to be successful. Is this the case? Is there a better way to do it that does not involve me adding 1000s of AD user objects? These devices already have certs issued to them.

Any guidance is appreciated.

Thanks.
0 Kudos
1 ACCEPTED SOLUTION

Go to solution
Ryan_Yacobucci
Extreme Employee

‎08-06-2019 05:25 PM

Hello,

An active directory object is not required for successful authentication when using EAP-TLS authentication.

When using EAP-TLS you set NAC to "Local Authentication" and install necessary RADIUS certificates and Trusted Authority certificates on the NAC itself.

NAC will provide it's RADIUS certificate to the client for validation, then the client will send it's certificate to the NAC for validation. As long as the AAA trusted authority certificate installed is the same certificate that signed the client certificate authentication will be successful.

There is no computer or user account necessary as EAP-TLS is not password based authentication.

The problem that you will run into is that without any AD objects it may become difficult to put these into authorization roles as since there are no AD objects we cannot utilize and AD technologies like security containters. LDAP lookups will not work if there are no objects in AD.

We can still use the CN of the certificate to provide an authorization though.

Thanks
-Ryan

View solution in original post

0 Kudos
6 REPLIES 6

Go to solution
Stefan_K_
Valued Contributor
In response to WagoL

‎01-22-2024 02:11 PM - edited ‎01-22-2024 02:12 PM

@WagoL

What exactly do you need, where do you have problems?

Local Auth and Trusted Authority Certs: AAA Config

Radius Certificates: Engine Configuration -> Certificates

0 Kudos

Go to solution
Seth_Bean
New Contributor III

‎08-06-2019 04:34 PM

I would create a rule for voip to prioritize traffic and put it on its own vlan. Phones really should be on their own vlan, and work well with Control to do that on the fly. I'm not sure why you'd want to go through all that effort. I would just put that traffic on its own vlan with its own authentication rules.
0 Kudos
GTM-P2G8KFN