Network Adminssion Control, 802.1x & Novell Clients to have a single login.

Hi Sir,
My customer would like to have OTP, if NAC and 802.1x come into picture. At the moment, they are running Novell client for Windows version 4.9SP2 authenticating to Novell LDAP server.
How can NAC and 802.1x be integrated into one time password (OTP)? If not what is the alternative best solution can we propose to them ?

With NAC Phase 1, which uses IOS Routers as the NAD, the Trust Verification occurs using EAP over UDP. User credentials are not part of the items passed by the CTA to the policy server. So however you log into the machine will be your authentication experience.
With NAC Phase 2, which uses L2 switches as the NAD, the Trust Verification is planned to use EAP over 802.1x. The user will be authenticated and authorized by the switch by way of the ACS AAA server. The 802.1x supplicant that you use will dictate whether or not a single login occurs. Choices for supplicants include the embedded supplicant Microsoft offers and supplicants from 3rd parties, such as Funk.
So you do not have to wait for NAC Phase 2 to take advantage of NAC today. While planning for NAC Phase 2, it would be a good idea to plan out your 802.1x strategy & even implement 802.1x to make sure it is ready to layer the NAC Trust Verification on top of it.
Please let us know if you have any follow-up questions.
thanks
peter
ps - pls rate these posts so we know if we have provided you with an answer that helps!

Similar Messages

Novell Client and Login Scripts?

All:
I'm a former administrator of NetWare 3.x, 4.x and 5.x systems and am
intrigued by the NLSBS 9 offering. I have downloaded the trial version
and have installed it on a test server.
Since I am "old school", I was wondering if I could use the Novell Client
for Windows XP and login scripts to automatically map shares using groups
like I did back in the day.
I'm very new to the Novell/Linux world since every organization I've
worked for in the past 10 years abandoned NetWare for Windows. I'm sure
a LOT has changed since the Linux OS was brought on board, so I thought
I'd ask.
Thanks,
Greg

Not sure. It would depend on whether Novell is still offering a product upgrade to the OWS from Windows 2000 SBS and what that price looks like. Otherwise, I was more thinking about the software side itself, re: the Linux side. Either way will work. Just work out the figures.
>>> <[email protected]> 5/23/2006 5:02 am >>>
I guess I'm looking at it this way: If I purchase the 5-user upgrade
license of NLSBS for $211.00 which includes upgrade protection, then
according to Novell, I can upgrade to OWS for free after July 31st. A 1-
user license for OWS at CDW is about $125.00. $125.00 x 5 = $625.00.
Is my logic flawed?
> Why not just get the Open workgroup suite? Its basically the same
thing, =
> but you will have todays licences instead of the licence that is
already =
> obsolete according to Novell.
>
> >>> <[email protected]> 5/17/2006 12:30:13 pm >>>
> Will do. Thanks guys!
>
> I'm getting ready to pull the trigger on purchasing the Novell Linux=20
> Small Business Suite product. I'm going to get the Upgrade version =
> with=20
> 5 users licenses and one year of upgrade protection for a little over=20
> $200.00 from CDW. I guess I can get by with the Upgrade version since =
> I=20
> have a full retail copy of Microsoft SBS 2000 still in the
shrinkwrapped=20=
>
> box. Also, a representative of Novell told me in an e-mail today that =
> if=20
> I have upgrade protection on NLSBS, then I can upgrade to the new =
> Novell=20
> Open Workgroup Suite for free when NLSBS goes out at the end of July.
>
> Sounds like a win-win to me...
>
> Thanks again,
> Greg
>
> > I also had a link to a cool solution, that explained how to use
LDAP=20
> etc.. =3D
> > to link up NDS to the Linux box so you could use that to manage user
=3D
> > accounts.
> >=20
> > Let me know if you need that and I can dig it up.
> >=20
> > >>> <[email protected]> 5/16/2006 10:05:48 am >>>
> > All:
> >=20
> > I'm a former administrator of NetWare 3.x, 4.x and 5.x systems and =
> am=3D20
> > intrigued by the NLSBS 9 offering. I have downloaded the trial=20
> version=3D20
> > and have installed it on a test server.
> >=20
> > Since I am "old school", I was wondering if I could use the Novell =3D
> > Client=3D20
> > for Windows XP and login scripts to automatically map shares using =3D
> > groups=3D20
> > like I did back in the day.
> >=20
> > I'm very new to the Novell/Linux world since every organization =
> I've=3D20
> > worked for in the past 10 years abandoned NetWare for Windows. I'm
=3D
> > sure=3D20
> > a LOT has changed since the Linux OS was brought on board, so I=20
> thought=3D20
> > I'd ask.
> >=20
> > Thanks,
> > Greg
> >
>

802.1X Novell Chap authentication problems

Ok, I've got FreeRadius up and authenticating successfully to eDir with
LDAP. If I boot workstation only and use the built in Microsoft
supplicant, etc. PEAP MSCHAP, I can authenticate to my access point
using my edir credentials. Then I can click on the Novell client and log
into the network.
If I turn on the Novell Client 491sp4 802.1X support which puts in the
Novell Chap as the authentication method it stops working. The
Freeradius server shows the error <no password attribute> just as if my
Universal Password wasn't set. But it is because it works with MSChap as
the authentication method.
I've applied all the Microsoft KB patches for WiFi I can find listed
here in the listserv. Even the one that you have to submit to MS to
receive 923154. I've set supplicant mode to 3 in the registry. I'm
really at a loss.
I'd just love to have the Novell Client do single sign on to our WPA
protected wireless. Any advise is greatly appreciated. I see some of you
have it working with minor problems. Can you help this long time Netware
user since 2.X in college get it going too?
Thanks in advance.
-Nyle

Nyle F. Landas wrote:
> If I turn on the Novell Client 491sp4 802.1X support which puts in the
> Novell Chap as the authentication method it stops working. The
> Freeradius server shows the error <no password attribute> just as if my
> Universal Password wasn't set. But it is because it works with MSChap as
> the authentication method.
Addendum: I've got it so if I log into Workstation only, it will
authenticate using the Novell MSCHAP. It just won't authenticate with
the Novell Client so that I have a single sign on.
The error from the client changes but most of the time I get - "802.1X
Found no connections to authenticate" Sometimes I get "802.1X
Authentication failed. Timeout waiting for Authentication to finish.
Logging into workstation only."
If I set SuppliantMode to 3 it also won't even authenticate when I log
in as workstation only. If I delete that key it will at least work at
the workstation only.
Again I believe I've applied all KB from Microsoft. Did I miss something
simple? HELP, Please......
-Nyle

Wireless Security and Novell Client

To all,
I am currently looking to upgrade our existing Network Infrastructure toa secure 802.11b network and we have purchase Cisco Secure ACS. We plan to use LEAD with our system and require a radius sign-on using our Novell Client. The problem I have is planning this and how I can setup the workstations. We use ZEN Works for our management of workstations and this means that the Novell client must be the primary sign-on. How can I get the Novell client to be the primary sign-on and still use LEAP? The Novell client requires a network connection before it can bring up a login screen. Any thoughts or tips would be greatly appreciated. Have a great day!
Adam Osterholt
Network Manager
The Children's Medical Center
Dayton, OH

We have the same configuration here at my place of work (Novell, ACS, ZEN,etc). In my testing it depended on the OS that the client was using. On the win95/98 clients I had to set the primary login to the Novell client but save the LEAP user name and password in the wireless profile within the ACU on the client. During the client boot up, the LEAP username logs in automatically and the Novell login screen appears for login. I could not get it to work properly with prompting the user to enter their LEAP username/password. This process only work as login as my ACS server database was local to the ACS server. If the ACS server is set to use an NT domain as its user DB the LEAP auto-login did not work....
I did not have this problem with win2000 or winXP clients.
Hope this helps.
Rob

Removing Novell Client from Windows 7

Hello,
We have an issue with programs running slowly on our SUSE Linux server 11.0. We set up a test machine with Windows 7 without Novell Client and the same programs run extremely fast. (They run fast on a Windows 2008 server too with or without the client.) This is great for the new test machine but I have about 20 workstations that need to have the Client removed. If we remove it through control panel (both NICI and Novell Client - whatever version is installed) the programs are still slow. However, if we do a restore to the time before the Novell client was installed, the machine is fast. Because these machines have had the Novell Client installed for months, we cannot go back to an old restore point. Is there some registry file or other file that needs to be removed or changed to make the computer like it was installed without the Novell Client? I really do not want to have to rebuild 20 computers in order to fix this. I have researched the web and forums and cannot find any information about anything else that needs to be changed when the Novell client is removed. FYI - this is the same on our few Windows XP machines with the appropriate last updated Client on them.
Any help would be welcome!
Susan

We have had many issues with the Novell Client / Windows 7. Here is what we have done to get to an acceptable point.
We are running OES 11SP1 fully updated up until July (Getting ready to apply more updates), we are also talking about switching from CIFS to Samba as we have been seeing some weirdness with CIFS and NSS disconnects.
OES11 SP1 - Primary File Server NSS with CIFS
OES11 SP1 - DSFW/DNS Server for Domain Authentication for the CITRIX Servers, this server also runs ZCM 11.2.2 (Also going to update this as we need windows 8 support and the ZCM Agent has some issues at this level; however ZCM has a horrible way to apply updates and is time consuming)
OES11 SP1 Squid Proxy With transparent user authentication using LDAP with SquidTrust. Also has NSS Shares
Other servers exist as well.
We standardized on Novell Client 2 SP3 or Greater. Currently SP3 IR3 is what is in use. But prior to SP3 the client had many issues for us.
Also, We do not use Group policy with ZCM (We tried But it was painful and slow and policies would randomly just quit working / remove themselves) we reverted back to just digging in and finding the registry keys. If a key only existed in the Policy Section we put it there and do a GPUPDATE /force on login.
Server Settings:
Disable OPLOCKS
Workstation Settings:
NW Client Settings
File Commit (Enabled)
File Cache (Disabled) - NW Client Setting
Name Services DNS / SLP Only (Default on the newer Netware Client)
Win7 Machine Settings:
Static DNS Server - Set to the internal servers only. No external server set. The win 7 machines for some reason would use the secondary DNS Server randomly instead of the primary, never really dug in on why but disabling / removing a public DNS Server as the secondary and adding in a second internal.
MS Client For Microsoft Networks Remove, We tried changing the preferred order on the network adapters with no help. I believe the fact that we are running CIFS on the Server side the client is having issues with deciding on how to connect to the NSS Volumes when the client is installed. With the MS Client removed we see a huge improvement In the Novell client.
Libraries Disable - Registry - We redirect Documents Folders and such and these libraries are wanting to index the locations. As the Libraries consist of multiple locations.
Offline Files Disable - Registry
Windows Search Disable Registry (Service)
Zone Mapping - Registry Adds the servers & domain to the Trusted list for the OS (Even though it says Internet Explorer its used by other portions of the OS)
User Access Control Registry
I have others that helped but this is the short list of changes that made major improvements.
When I have a moment I will look back and see if there are other major changes. This is just what I remember.

CSA & Novell Client

We run a Novell network and our primary authentication client is the Novell client. I've setup CSAMC v6 and have been tuning for the past couple of days.
I seem to have a problem with the Novell client login script. Whenever I login, the search drives don't map. I get:
FS-TBRHSC-ZEN
LOGIN-LGNWNT32.DLL-890: The specified server is unknown.
LOGIN-LGNWNT32.DLL-430: The following drive mapping operation could not be completed.
[ROOT S16:=Z:=FS-TBRHSC-ZEN\SYS:PUBLIC]
The error code was 8884.
I've opened up TCP/524 and TCP/427 to all of our Novell servers with no results. I thought it might be ephemeral ports to I opened them up as well.
This is really frustrating the heck out of me. Does anyone have a solution?
Ryan

I have tuned Novell in CSA 4.0, and upgarded the rules to 6.0 and they seem stable. Please e-mail me at dhudson at hanover dot com, and I will send you na export of my Novell tuning...

Novell Client for Linux 2 beta & VMWare - bridged only?

OpenSUSE 11.1 with Novell Client for Linux 2.0 SP2 beta.
OpenSUSE is installed as a VMWare Workstation guest using NAT. When attempting to use contextless login, the Novell Client hangs. If you disable contextless login and then browse to the right context, you can login OK.
If you change the virtual NIC from NAT to Bridged, contextless login works fine. If at all possible, we need to use Bridged instead of NAT (long story).
Any idea what could be the problem? From what I can tell, SLP, DA, etc are set correctly, but I could be wrong.
Thanks.

Originally Posted by Thorsten Kampe
* mlazovjp (Mon, 14 Dec 2009 18:56:02 GMT)
> OpenSUSE 11.1 with Novell Client for Linux 2.0 SP2 beta.
>
> OpenSUSE is installed as a VMWare Workstation guest using NAT. When
> attempting to use contextless login, the Novell Client hangs. If you
> disable contextless login and then browse to the right context, you can
> login OK.
>
> If you change the virtual NIC from NAT to Bridged, contextless login
> works fine. If at all possible, we need to use Bridged instead of NAT
> (long story).
>
> Any idea what could be the problem? From what I can tell, SLP, DA, etc
> are set correctly, but I could be wrong.
Use NAT only if you need NAT - otherwise use bridged.
Thorsten
I was afraid that someone was goign to say something like that :)
We use port security hardware on our network, which will disable a port on the switch if it detects multiple MAC addresses on the same port. A virtual machine's bridged networking sets port security off and disables the port, so we have had to resort to NAT for all virtual machines. We can ask for exceptions to be made for a subset of our lab computers, but that is not an ideal solution.
Not only is that extra overhead for us to manage these exceptions, but we will not be able to realize our long-term goal of providing the virtual machine to our students to use on their personal notebooks since we cannot provide them port security exceptions.
I am still having problems grasping the reason that a contextless lookup (via LDAP, I assume) would misbehave while coming from a NATted connection but a bridged connection works fine on the exact same virtual machine. Shouldn't the communication between the VM and the LDAP server work properly either way??

Login intermittently slow with ZCM agent AND Novell client

We continue to struggle with intermittently slow logins in our environment. In testing, we noticed that logins are very fast (10-20 seconds) when only the Novell Client is installed, and very fast (~10 seconds) when only the ZCM agent is installed. However, when they are both installed, logins slow down, sometimes to 1.5 minutes or longer.
We have checked DNS and rDNS, and they are both configured properly. SLP is working properly as demonstrated by the fast logins when only the client is installed. We use LDAP for user lookup, and it also works very fast to resolve user names (~ 1 second).
We are using ZCM 10.3.1, and the client is fully patched as well (both Novell Client 2 and 4.91)
Are there any specific settings (for the ZCM agent or the client itself) that might address this issue?

My apologies, I told you to remove the wrong thing.
I should have said NMAS instead of CASA.
I am just so used to saying CASA when talking about ZCM.
In regards to NMAS, you could simply rename "NWSSO.DLL" as a test.
If NMAS is installed which is tested by the existence of this DLL, then
a certain NMAS call is always made, which in some cases can take a long
time.
On 11/9/2010 12:06 PM, dshofkom33 wrote:
>
> craig_wilson;2042688 Wrote:
>> Try removing CASA from the device and see if that makes a difference.
>> A TID will be out on the issue soon.
>>
>> On 10/5/2010 4:36 PM, kjhurni wrote:
>>>
>>> Hmm, I will have to try that. I've only observed that with ZCM
>>> installed (with Novell Client 4.91 SP5 on XP) that the login time
>> goes
>>> from about 12-15 seconds to about 50-70 seconds.
>>>
>>> But I've not tried "just" the ZCM agent.
>>>
>>>
>>
>>
>> --
>> Craig Wilson - MCNE, MCSE, CCNA
>> Novell Knowledge Partner
>>
>> Novell does not officially monitor these forums.
>>
>> Suggestions/Opinions/Statements made by me are solely my own.
>> These thoughts may not be shared by either Novell or any rational
>> human.
>
> I removed CASA and now I cannot sign into ZCM. I get the "unable to
> login to network because the login credentials are incorrect" Windows
> Security Message. Any ideas?
>
>
Craig Wilson - MCNE, MCSE, CCNA
Novell Knowledge Partner
Novell does not officially monitor these forums.
Suggestions/Opinions/Statements made by me are solely my own.
These thoughts may not be shared by either Novell or any rational human.

Import Novell Client ADM to Zen 10

What is the secret to creating a Policy in Zenworks 10 that controls the Novell client? I do not see any place that I can import an ADM file and then create a policy using it.
Another question is will the client ADM file 4.9 work for the Vista 64 Novell client? If not, is or will there be one soon for Vista?
Thanks

There is demand...I hope at least. We are in the process of rolling our Vista 64 Business because of an CAD application, Revit, that just needs the extra resources. We held off as long as we could but were forced to move on. We have the Novell client loaded and all works fine, but we would just like to turn off some of the Novell options the client installs. We also had to upgrade to Zen 10 for the Vista support. If you do an update to the adm file, please let me know!
thanks.
Originally Posted by spond
Txrjohnson,
What Andrew said :)
> Another question is will the client ADM file 4.9 work for the Vista 64
> Novell client? If not, is or will there be one soon for Vista?
>
You could ask the author... oh wait, that's me - I hadn't planned to,
but I could try to find time if there was demand...
Shaun Pond

Control what AnyConnect VPN clients can Access

Hello!
How do I ensure that my VPN users that are connected using AnyConnect VPN to my ASA5520 have the same access restrictions/permissions as those connected locally?
Assign a pool in the same vlan/subnet as those connected locally?
Any input helps. Thanks

Your annyconnect RA clients should have unique separate network from any other internal subnets and you will find much easier management and administration as soon as you start creating different RA tunnels for different purposes in future, at least this is my practice and find easy to administer and/or troubleshoot. If you decide using VPN tunnel network the same as an inside subnet you may encounter problems down the road which will be hard to troubleshoot.
Now you have VLAN10 subnet internally, if I understand correctly you want RA clients have the same access VLAN10 users have,my question to you is what type of access are you refering to? does VLAN10 users have access to certain internal networks or specific hosts and some don't? if this is so when you use vpn filters build the same access control you have defined for VLAN10 users, you don't necessarily have to create per user vpn filers but rather a group policy defining the permit access through the acl and apply it to the Annyconnect RA tunnel if the intend is for the whole tunnel group, just as shown in the RA vpn filter example link posted excluding the per user vpn filer.
Rgds
Jorge

Novell Client dirty uninstall

Due to the temporary misconfiguration of an Enterprise patching solution I accidently got the Novell Client and NICI installed on my notebook. We have nothing Novell on our network.
Unfortunately despite uninstalling everything Novell related I still have "Novell Logon" at login on my machine and smart card login has stopped working.
This notebook is running Windows 7 Enterprise.
How can I clean up the mess which installing this client has caused?
Rob

On Wed, 09 Jul 2014 21:46:01 GMT, rehardy
<[email protected]> wrote:
>
>Thanks for the assistance. I got a bit further with the new installer.
>Installing it allowed me to get rid of the Novell Login on the login
>screen but NICI was still left with broken uninstall links after
>"uninstall".
>Manually uninstalling NICI cleaned up that mess but the system still
>refused to accept smart cards when RDPing to it.
>I give up. I'll just re-image it.
I've never had problems with uninstalling Novell Client, although I
must admit I don't do that very often. But I have come to the
conclusion anymore that it is faster to re-image a PC than it is to
troubleshoot problems on Windows.
Ken

Novell client 504 gateway error

Hi
I am using novell client to access CRM application remotly.
While trying to record scripts for load testing I am getting
Novell 504 gateway time out error
Connect to server administrator
What is the proble reason for the issue and any resolution to overcome this issue
its urgent
Thanks in advance
mukul

Novell Client is a network software for remote desktop connections to Virtual drive
I am getting this error while recording the Oracle CRM application, even login page which is a web page is also not opening.
when i click on Record button a new browser is opening ,once i put the url it waits for sometime and then it shows the gateway 504 timeout error
thanks for the quick reply

Novell Client Login Check?

I have seen a slow increase in students at several of my schools either failing to log into Novell to get drive maps or logging into the computer thinking they are logging into Novell and still not getting the drive maps. I was looking at making a bundle or script that would check specific drive maps (like If I: exist then bypass the login otherwise bring up the Client login prompt). I would like for the process to check for the specific network before moving on to the client login prompt so was hoping to use ZCM location awareness to do this. I would also like to integrate a proxy setting change at the same time to change depending on the location the user is connected at.
Anyone do this that might be willing to share how they have it working?
Thanks
Richard

Rhuhman,
> (like If I: exist then bypass the login otherwise
> bring up the Client login prompt).
Check for I:\NUL and act accordingly.
Anders Gustafsson (NKP)
The Aaland Islands (N60 E20)
Have an idea for a product enhancement? Please visit:
http://www.novell.com/rms

Is VPN an option with Novell Client?

We're trying to set up something similar to a VPN on our network so
multiple out-of-office employees can access our network and work on our
files simultaneously. We have Novell Small Business Suite 6 and use a PC
as a makeshift server.
Does Novell Small Business Suite 6 or Novell Client have this capability?
If so, how would we set this up and what are the limitations (i.e. would
it just send screenshots and keystrokes across the internet connection or
the actual files themselves?)?
Any help you may have on this would be greatly appreciated. Thanks!

VPN is a part of the Bordermanager piece. The docs cover this.
There are other possibilities to provide remote access to files. The
question is what features do you want to use.
Here are a couple possibilities:
-iFolder
-NetStorage
-Virtual Office (part of NetWare 6.5)
-NetDrive
-GroupWise Document Management
Each has possibilities that might do what you want. You might want to
read up on the features of each to help you start down the road of the
product that will do all you need.
http://www.novell.com/products/?sour...lutions:%20Pro
ducts%20a-z
Look under Open Enterprise Server/NetWare and GroupWise.
Timothy Leerhoff
Novell Support Forum Sysop

Deploy novell client

For a customer i've set up ZLM, OES and SLED.
- what is the easiest way to distribute the novell client?
currently i have created a rpm bundle, containing all rpm's on the novell client cd.

lowalcohol,
... but to be honest... I do not want the client, I want to use centrally managed login scripts, to map samba/ncp shares...
that is one of the things the Novell client allows you to do. You define the login scripts once in edirectory and the Novell clients, independent where they are, use them when they login. Okay it depends if you have logical structures in edirectory and different sites, then you might need them twice or more times, but it is a perfect solution you can manage from a central point.
So to your question ...
When I check as a sample the SLED 11 Novell client, I see that the installation media is already usable as a installation source.
So one option might be to use a remote execute policy to add it as a zypp source temporarily via "rug sa -t zypp <network path to the client> NWCL" on each client and trigger the installation. The problem is that it is not only a instalaltion of rpm packages, there is a yast module that does all the configuration for the novell client afterwards. I don't know if there is a console command that does all the same. In other cases the configu files must be collected that are touched by yast and then the remote execute policy should do the same.
A second option would be to put all rpms into a bundle and then use the post installation script to make all the additional system configurations that were done via yast.
So far this seem to be the two options you can choose from ...
What do you think ?
Rainer

Network Adminssion Control, 802.1x & Novell Clients to have a single login.

Similar Messages

Maybe you are looking for