After you enable the access authentication service on an on-prem a host, you must associate the on-prem host with need to associate an authentication profile with the host in order to synchronize user groups. You can create multiple authentication profiles, but you can only enable one authentication profile for each on-prem host. In addition, you can exclude access authentication for devices and network users located on a separate subnet; to do this, enable or disable specific profiles for exclusion.
To configure authentication profiles for an on-prem a host, complete the following:
- From the Cloud Services Infoblox Portal, click Manage > On-Prem HostsConfigure > Service Deployment > Protocol Services.
- Select an on-prem host from the list and click Service > Create Services > Access Authentication > Configure.
- In the Configure Create Access Authentication wizard > Access Authentication dialog step, click Add and choose an available authentication profile from the list. Only an enabled profile can be associated with the host you selected. Note that you can only add multiple profiles only if they are of different protocol types and you can enable only one profile for each on-prem host.
- To enable or disable a profile for exclusion, select a tagged IP space from among the list of available IP spaces. Next, choose a Tagged Authentication Mode from the following:
- Disabled: Tagged authentication control is disabled. All clients must authenticate use.
- Exclusions: Clients from the address scopes are tagged for exclusion bypass authentication. Other clients must authenticate.
- Inclusions: Clients from the address scopes tagged for inclusion must authenticate. Other clients bypass authentication.
- Both: Clients from the address scopes tagged for inclusion or from untagged scopes must authenticate. Clients from the scopes tagged for exclusion bypass authentication.
- Click Save & Close.
Access Authentication Exclusions
Access authentication exclusion is used to bypass the authentication process for desired devices. This is useful for devices which cannot otherwise be authenticated. By adding these devices to a subnet or to an IP address or IP addresses within a block, and then excluding the subnet or IP addresses from the authentication process, the devices are excluded from going through the authentication process.
Access authentication exclusions based on subnets or individual IP addresses require configuring an IP space and the assigning of a tag in order to to function. When Tagged Authentication Mode is set to Exclusions mode, the subnet or IP addresses within the IP address block tagged for exclusion bypass authentication will be exempted from the access authentication process.
...
- . For information, see Configuring Authentication Profiles.
- Click Next to view the summary of your configuration.
- Click Save & Close.