u/lertioq

I am confused about how to set up EAP-TLS authentication for Android and IOS phones, using Microsoft NPS.

We already have EAP-TLS certificate authentication for our domain computers. So basically:

\-          The computers get a certificate from the CA

\-          The computers are in an AD-group

\-          On the Windows NPS server, there is a policy granting access, using the AD-Group as Matching Condition

 

That works like it should. Now, we have the task to also implement this for android an ios phones tool. We already managed to roll out certificates via Intune, however I’m not sure how to setup the NPS site for that. As these are no Domain Joined devices, they are in no group.

How would a have to set up a policy in NPS for these phones?

I’m trying to migrate my SSL VPN to Ipsec, but I can’t make it running. I’m trying to authenticate with a local user account. The user is part of the group “MYGROUP”.

Here’s the log:

ike 0:CLIENT-VPN:2914: received FCT-UID = 1D0334450AFC42F0981EAA747F95858A

ike 0:CLIENT-VPN:2914: received EMS SN :

ike 0:CLIENT-VPN:2914: received EMS tenant ID :

ike 0:CLIENT-VPN:2914: peer identifier IPV4_ADDR X.X.X.X

ike 0:CLIENT-VPN:2914: re-validate gw ID

ike 0:CLIENT-VPN:2914: gw validation OK

ike 0:CLIENT-VPN:2914: construct EAP response message using IDi

ike 0:CLIENT-VPN:2914: send EAP message to FNBAM

ike 0:CLIENT-VPN:2914: initiating EAP authentication

ike 0:CLIENT-VPN: EAP user "C0A808A3"

ike 0:CLIENT-VPN: auth group MYGROUP

ike 0:CLIENT-VPN: EAP 1520644800 pending

[1939] handle_req-Rcvd auth req 1520644800 for in MYGROUP opt=00000000 prot=8

[489] __compose_group_list_from_req-Group 'MYGROUP', type 1

[616] fnbamd_pop3_start-

[378] radius_start-Didn't find radius servers (0)

[765] auth_tac_plus_start-Didn't find tac_plus servers (0)

[1009] __fnbamd_cfg_get_ldap_list_by_group-

[1117] fnbamd_cfg_get_ldap_list-Total ldap servers to try: 0

[497] ldap_start-Didn't find ldap servers

[480] fnbamd_cfg_get_ext_idp_list-

[454] __fnbamd_cfg_get_ext_idp_list_by_group-

[460] __fnbamd_cfg_get_ext_idp_list_by_group-Group 'MYGROUP'

[490] fnbamd_cfg_get_ext_idp_list-Total external identity provider servers to try: 0

[643] create_auth_session-Error starting authentication

[1086] fnbamd_ext_idps_destroy-

[1980] handle_req-r=5

[1988] handle_req-Error starting session

[209] fnbamd_comm_send_result-Sending result 5 (nid 0) for req 1520644800, len=2540

ike 0:CLIENT-VPN:2914 EAP 1520644800 result FNBAM_ERROR

ike 0:CLIENT-VPN: EAP failed for user "

ike 0:CLIENT-VPN: EAP response is empty

ike 0:CLIENT-VPN: connection expiring due to EAP failure

ike 0:CLIENT-VPN: deleting

[2485] handle_req-Rcvd abort req for 1520644800

[2500] handle_req-Can't abort, no active req 1520644800

What I did so far:

-          In CLI, I enabled EAP under config vpn ipsec phase1-interface

-          I tried setting authusrgrp to “MYGROUP”, but that’s not changing anything

-          There are access rule that include this group

 

Any inputs are highly appreciated.

I’m new to Hyper-V and I’m wondering about the best way to setup our Backup infrastructure with Veeam Backup and Replication.

So far, we were using VMware. Our setup usually looked like this:

- ESX Hosts and vCenter are in a Management VLAN/Subnet

- Backupserver is in Backup VLAN/Subnet

- ESX Hosts have an additional VMkernel Adapter with an IP address within the Backup VLAN/Subnet

- Backup Server has entries in its Host file, pointing the hostnames of the ESX hosts to their IP address in the Backup subnet 

That way, restore operations are not routed and go directly over layer 2. How would a comparable setup look in Hyper-V?

I recently updated a 40F from 7.2. to 7.4.12 a couple of weeks ago. Everything worked fine so far. Today, however, I realized that I can’t connect via SSL VPN, and also can’t access the management gui (management is enabled on the WAN interface – yes, I know that’s not recommended).

When accessing the gui, I get a “ERR_SSL_PROTOCOL_ERROR” in Chrome, and a “SSL_ERROR_BAD_MAC_READ” in Firefox.

The firewall is at a remote location, so I don’t have access to the console. The firewall itself seems to work, traffic is still flowing.

Anyone here who had something similar? Is there anything I can do except try to have it rebooted?

I have the task to implement 802.1x for our wired clients on Aruba CX switches with Microsoft NPS. However, I’m not completely sure how to set this up.

Currently, our default switchports look like this:

interface 1/1/1
vlan trunk native 10
vlan trunk allowed 10,20

 

10 is the client vlan, 20 is the vlan for phones. VLAN 20 is configured as voice vlan via the “voice”-command. There are some ports, where the client is connected through the phone.

My plan was to authenticate the clients through certificates, and the phones through mac authentication.

I thought about creating a local port access role on the switch with vlan native 10 and vlan trunk allowed 10,20, and have it assigned by NPS through a vendor-specific attribute.

Is this the right way to do that?

Sorry if that’s a noop question, but I’m totally new to Hyper-V. I have a Hyper-V cluster with 2 Nodes, and a Domain Controller running on each host, outside of the cluster. Now I need to patch it for the very first time. First thing I did was patching each Domain controller. However, I’m not really sure what’s best practice when it comes to patching the hosts.

I migrated all the VMs to one node. Do I need to pause the host that I want to update? If yes, do I need to drain the roles?

Are there any other steps necessary?

I have an Epson TM-T88VII where I need to disable "Secure Print". However, when I try to disable it through the Web GUI, the whole UI seems to crash, and after a reboot, "Secure Print" is enabled again.

I already found a hint that you need to this within the same subnet of the printer, but I already tried that.

Any ideas?

We just created our very first Hyper-V cluster. Our setup looks like this:

-2 Hyper-V hosts

- 1 Domain Controller running on each host, outside of the cluster, for a separate infrastructure domain

- Both servers are joined to the domain

 Are there any specific steps recommended to harden such an infrastructure domain, or do you know of any specific guide to follow?

I have a problem understanding the communication between Fortimanager and remote firewalls.

I have a Fortimanager, sitting behind a Fortigate firewall, managing about 10 firewalls. All the firewalls, except the one on the HQ where the Fortimanager is, are at branch locations.

On the HQ firewall, I see that there is a VIP configured for the Fortimanager Access, mapping a public IP to the internal one. On the branch firewalls, I checked “config system central-management”. I expected the public IP of the HQ to be configured there, but that’s not the case.

So, my question is: how do the branch firewalls know where to find the Fortimanager? We need to change the public IP at the HQ in the next couple of weeks, so I need to know where I have to make the adjustments on the firewalls.

I have a weird issue that I don’t understand.

I have a Fortigate, running on 7.2.12. I created an ipsec tunnel to a different non-Fortigate branch firewall. As there are overlapping IPs, I created a VIP and a Dynamic IP pool, type “Fixed Port Range” on the Fortigate.

So, my access rules look like this:

Rule 1: branch-to-hq, using the VIP as destination

Rule 2: hq-to-branch, NAT enabled, using the ip pool

Rule 3: hq-to-WAN, NAT enabled, Use Outgoing Interface Address

 The problem is: Since I created Rule 1 and 2, the traffic going to the Internet is translated to the IP defined in the ip pool, even though the NAT settings are set to “Use Outgoing Interface Address”. In the logs, I can see that the Outgoing Interface is the WAN interface.

Anyone here ever had an issue like this?

I have a problem here that I don’t really understand, and I hoped someone could explain to me whats going on.

I have the following topology here with Aruba Switches

- SW1 and SW2, configured as VSX with a virtual MAC, and both switches configured with spanning tree priority 0.

The cabling looks like this: SW1<->SW3<->SW4<->SW5<->SW2

On SW5, we configured the uplink port to SW2 with “spanning tree cost 200000”, because we wanted to know where spanning tree is blocking a port. That works, the uplink port is blocked.

However, recently, SW3 went down because of power failure, and SW4 and SW5 went offline as well. The uplink port on SW5 to SW2 remained in blocked, until I removed the cost setting.

Can anyone explain to me why this is happening, and why spanning tree didn’t unblock the port?