UAC deployment for 802.1x AD users

[eng_mahmood48_]

i have the below queries about the UAC deployment for AD users:

1- what is the best solution for the L2 802.1x Active directory connected PCs, since they will not have access to the AD server before user login (No IP address), is the Gina or the Machine Auth the best for this scenario?

2- is there limitations for GINA in windows 7?

3- what is the required configuratio for machine auth in the IC itself?

Thanks

[Stanislas P_]

Hello,

If you do not need user authentication to assign different VLAN associated to groups, the best solution is Certificate Machine authentication. the deployement of machine certificates is easy with GPO.

there is no difference between machine and user authentication in IC. but AD does not support LDAP machine authentication.

Regards,

Stanislas

[eng_mahmood48_]

Hello

i will use the assignment of remediation VLAN from the IC to the users whom didnt pass the policy check.

if the Certificate Machine authentication is the best, then how it works.?

- what about Gina, do you recommend it?

Thanks

[apaul_]

Hi,

On Windows 7 systems, the capabilities for GINA are provided by Credential Providers.

Feel free to refer the release notes, this should be a good resource for you to understand the known issues and limitations.

http://www.juniper.net/techpubs/en_US/oac5.3/information-products/pathway-pages/oac-series/oac-relea...

Thanks

[eng_mahmood48_]

is there a difference between the machine authentication and certificate machine authentication?

Thanks

[apaul_ · Accepted solution]

Typical machine authentication uses either a statically defined user account or the machine credentials that were created when the machine ID was set up in Active Directory.

In case of certificate machine authentication, users to be authenticated based on attributes contained in client-side certificates. You can use the certificate server alone or in conjunction with another server to authenticate users and map them to roles.

Thanks

[yuvarajR_]

Hi,

can i get a step by step procedure for configruing certificate based authentications using local & also conjunction with another server? pls its very urgent.....

---

@apaul wrote:

Typical machine authentication uses either a statically defined user account or the machine credentials that were created when the machine ID was set up in Active Directory.

In case of certificate machine authentication, users to be authenticated based on attributes contained in client-side certificates. You can use the certificate server alone or in conjunction with another server to authenticate users and map them to roles.

Thanks

---

[apaul_]

Hi,

I am not sure whether sure a document like the one that you are looking for is available or not.

However you could open a JTAC case, for technical assistance on your requirement.

Thanks