Wi-Fi employee access – ExtremeCloud IQ

In this topic, you will learn how to configure ExtremeCloud IQ to work together with Portnox™ Cloud and 802.1X RADIUS authentication for Wi-Fi connections.

Important:
This guide gives general instructions for integrating Portnox Cloud with specific third-party devices. We try to provide useful examples for common models, but settings can differ between manufacturers, models, and environments. Because of this, we cannot guarantee these steps will work in every case. For questions or problems with RADIUS setup – which is an industry standard and not specific to Portnox – or with device-specific settings and troubleshooting, we recommend checking the device manufacturer’s documentation and contacting their support team. Portnox Support can help when possible, but detailed setup of third-party devices is usually best handled by the manufacturer. We also recommend updating your NAS device firmware to the latest version, as old firmware can cause issues.
Important:
All values in this configuration are examples. Make sure to adjust the configuration to your individual profile names, RADIUS server addresses, ports, and keys by replacing the values that are presented as underlined italics.
Note:
This topic assumes that you already have ExtremeCloud IQ configured with a network policy, and that you have access points assigned to this network policy. In this topic, you only add new SSIDs to your existing network policy. After you add the new SSIDs, you must assign them to the relevant network policy and then apply the policy to the relevant access points. If you do not have a network policy or access points configured yet, see the following topic in the official Extreme Networks documentation to configure these first: Add a Network Policy.
Note:
ExtremeCloud IQ does not support RADIUS-based IPSK. Extreme’s equivalent feature, called PPSK (Private Pre-Shared Key), stores its credential database locally on the access points or in ExtremeCloud IQ’s own cloud, with no option to validate credentials against an external RADIUS server. Because of this, you cannot back PPSK with Portnox Cloud the way you can with IPSK on other vendors.
Note:
This configuration was tested on ExtremeCloud IQ 25.13.1-1. The capabilities and the user interface on other versions of the platform may differ.

Create IP objects for the Portnox Cloud RADIUS servers

In this section, you will create IP objects for the Portnox™ Cloud RADIUS servers. ExtremeCloud IQ uses these IP objects to reference IP addresses in external RADIUS server entries, which you will create in the next section.

  1. In the left-hand side menu of the ExtremeCloud IQ web interface, click on the following menu options: Configure > Common Objects > Basic > IP Objects / HostNames or go to https://va.extremecloudiq.com/#/common/ipobjectmanage.

  2. In the IP Objects and Host Names pane, click on the  +  icon in the toolbar to create a new IP object.

  3. In the New IP Object or Host Name pane, configure the new IP object:

    1. In the Name field, enter a display name for this object, for example, the name of the corresponding Portnox Cloud RADIUS server.
    2. Leave the type field set to IP Address.
    3. In the IP Address field of the only row in the table, enter the Cloud RADIUS IP value from Portnox Cloud.
    4. Click on the SAVE IP OBJECT button.
  4. If you use two Cloud RADIUS servers in both regions, repeat the above steps for the second RADIUS server.

    The above screenshot shows an example configuration with two added IP objects, one for each Cloud RADIUS region. Adjust the names and IP addresses to your tenant configuration.

Create the external RADIUS servers

In this section, you will create external RADIUS server entries for the Portnox™ Cloud RADIUS servers, using the IP objects that you created earlier. You will use these servers later when you configure your SSIDs.

  1. In the left-hand side menu of the ExtremeCloud IQ web interface, click on the following menu options: Configure > Common Objects > Authentication > External RADIUS Servers or go to https://va.extremecloudiq.com/#/common/extservers.

  2. In the External RADIUS Servers pane, click on the  +  icon in the toolbar to create a new external RADIUS server.

  3. In the External RADIUS Server pane, enter the details of the Portnox Cloud RADIUS server that you created earlier:

    1. In the Name field, enter a display name for this server.
    2. Leave the Type field set to Standard.
      Note:
      The Type field also offers a RADSEC option. Portnox has not, so far, been able to get this option to work with ExtremeCloud IQ and Extreme community discussions seem to suggest that this option is supported directly only with Extreme RadSec servers. If you need RadSec support for this integration, coordinate with Portnox support and Extreme Networks support on a joint call to resolve this with Extreme.
    3. In the IP/Host Name field, click on the list icon, and select the IP object that you created earlier for this Portnox Cloud RADIUS server.
    4. Activate both the Authentication and Accounting checkboxes in the Server Type field, and in the corresponding Port fields, enter the Authentication Port and Accounting Port values from Portnox Cloud.
    5. In the Shared Secret field, enter the Shared Secret value from Portnox Cloud.
    6. Click on the SAVE EXTERNAL RADIUS button.
  4. If you use two Cloud RADIUS servers in both regions, repeat the above steps for the second RADIUS server.

    The above screenshot shows an example configuration with two external RADIUS server entries, one for each Cloud RADIUS region. Adjust the names, IP objects, and port numbers to your tenant configuration.

Create an SSID for 802.1X authentication

In this section, you will create a new SSID and configure it for WPA2 Enterprise authentication, using the external RADIUS servers that you created earlier.

  1. In the left-hand side menu of the ExtremeCloud IQ web interface, click on the following menu options: Configure > Common Objects > Policy > SSIDs or go to https://va.extremecloudiq.com/#/common/ssidmanage.

  2. In the SSIDs pane, click on the  +  icon in the toolbar to create a new SSID.

  3. In the Wireless Network section, enter the Name (SSID) and the Broadcast Name for the secure SSID that you want to create, and activate the relevant frequency checkboxes in the Broadcast SSID Using field.

    Note:
    The value of the Name (SSID) field is only used internally by ExtremeCloud IQ. The name visible for clients is the Broadcast Name.
  4. Scroll down to the SSID Usage section, and on the SSID Authentication tab, select the Enterprise option, then in the Key Management field, select the WPA2-802.1X option.

    Leave the remaining settings, such as Hotspot, Encryption Method, Enable MLO, and Enable Captive Web Portal, at their default values unless your environment requires otherwise.

    Note:
    The process for configuring the SSID for WPA3 Enterprise authentication is almost identical.
  5. Scroll down to the Authentication Settings section:
    1. Make sure that the Authentication with ExtremeCloud IQ Authentication Service switch is set to OFF.
    2. In the Authenticate via RADIUS Server subsection, click on the  +  icon next to the Default RADIUS Server Group field.

    3. In the Configure RADIUS Servers pane, in the RADIUS Server Group Name field, enter a name for the RADIUS server group, then on the EXTERNAL RADIUS SERVER tab, activate the checkboxes next to the external RADIUS servers that you created earlier, and click on the SAVE RADIUS button.

      Note:
      The EXTERNAL RADIUS SERVER tab lists every external RADIUS server that you created, including any RADSEC-type servers. Select only the Standard-type servers for this SSID.
    4. The SSID page now shows the new RADIUS server group selected in the Default RADIUS Server Group field, with the servers that you selected listed in the table below it.

  6. In the User Access Settings section, review the Default User Profile value, and change it if you want clients on this SSID to receive a different VLAN or other user profile settings. Then, click on the SAVE button.

Result: You created an SSID that authenticates employee Wi-Fi devices using 802.1X and the Portnox Cloud RADIUS servers.

Optional: Create an SSID for MAC-based authentication

This is an optional task. Follow this task only if you want to authenticate devices, such as IoT devices, that do not support 802.1X, using their MAC address instead. Skip this task if you do not need MAC-based authentication.

Warning:
Do not activate both 802.1X and MAC-based authentication on the same SSID. When an SSID combines MAC authentication with another authentication method, ExtremeCloud IQ performs MAC authentication first. If MAC authentication succeeds, the access point continues with the rest of the authentication procedure. If MAC authentication fails, the access point denies network access and disassociates the client immediately, without attempting 802.1X authentication. Create a separate SSID for MAC-based authentication instead, as described in this section.
  1. In the left-hand side menu of the ExtremeCloud IQ web interface, click on the following menu options: Configure > Common Objects > Policy > SSIDs or go to https://va.extremecloudiq.com/#/common/ssidmanage.

  2. In the SSIDs pane, click on the  +  icon in the toolbar to create a new SSID.

  3. In the Wireless Network section, enter the Name (SSID) and the Broadcast Name for the SSID that you want to create, and activate the relevant frequency checkboxes in the Broadcast SSID Using field.

    Note:
    The value of the Name (SSID) field is only used internally by ExtremeCloud IQ. The name visible for clients is the Broadcast Name.
  4. Scroll down to the SSID Usage section, and on the SSID Authentication tab, select the Open option.

    Note:
    Do not select Enterprise here. Since MAC authentication becomes the sole means of access control on an open SSID, you do not need WPA2 or WPA3 Enterprise authentication on this SSID.
  5. On the same SSID Usage section, click on the MAC Authentication tab, and set the MAC Authentication switch to ON. In the Authentication Protocol field, leave the default PAP option selected.

  6. Scroll down to the Authentication Settings section:
    1. Make sure that the Authentication with ExtremeCloud IQ Authentication Service switch is set to OFF.
    2. In the Authenticate via RADIUS Server subsection, click on the  +  icon next to the Default RADIUS Server Group field.

    3. In the Configure RADIUS Servers pane, in the RADIUS Server Group Name field, enter a name for the RADIUS server group, then on the EXTERNAL RADIUS SERVER tab, activate the checkboxes next to the external RADIUS servers that you created earlier, and click on the SAVE RADIUS button.

      Note:
      The EXTERNAL RADIUS SERVER tab lists every external RADIUS server that you created, including any RADSEC-type servers. Select only the Standard-type servers for this SSID.
    4. The SSID page now shows the new RADIUS server group selected in the Default RADIUS Server Group field, with the servers that you selected listed in the table below it.

  7. In the User Access Settings section, review the Default User Profile value, and change it if you want clients on this SSID to receive a different VLAN or other user profile settings. Then, click on the SAVE button.

Result: You created a separate SSID that authenticates IoT devices by their MAC address using the Portnox Cloud RADIUS servers on the basis of MAC-based accounts.

Assign SSIDs to a network policy and update your access points

In this section, you will add any SSIDs that you created to a network policy, and push the updated policy to your access points. Changes to your network policy do not take effect until you complete this section.

  1. In the left-hand side menu of the ExtremeCloud IQ web interface, click on the following menu options: Configure > Network Policies.

  2. On the tile representing the network policy that you want to update, click on the ADD NETWORK button.

    Result: The network policy wizard opens.

  3. Click on the Select icon.

    Result: The SSIDs window opens.

  4. In the SSIDs window, activate the checkbox(es) next to the SSIDs that you created, and click on the SELECT button.

  5. In the wizard, click on the 6 Deploy Policy step.

    Result: The Apply the network policy to selected devices step opens.

  6. Activate the checkbox(es) next to the access points that you want to update and click on the UPLOAD button.

  7. In the Device Update window, select the Complete Configuration Update option, and click on the PERFORM UPDATE button.

    Note:
    We recommend a complete configuration update over a delta update, since it resets the device to match ExtremeCloud IQ's configuration exactly, rather than only applying changes. A delta update can leave stale settings on the device if earlier updates failed or were only partially applied.

Result: Your access points receive the updated network policy, and clients can now access the SSIDs that you created.