WC7600v2 really RFC 2866 Radius Accounting Compliant?

[PeterA23]

Hi Netgear Community,

Before I contact Netgear support to give feedback in regards to the quality of their wireless controllers I wanted to seek clarification from Netgear community about an issue we are currently facing at our site.

We would like to utilise the Radius accounting information generated by our WC7600v2 (firmware v6.5.1.11) to be utilised by our Windows 2012r2 NPS server. The specific attribute we need is the "Framed-IP-Address" attribute to contain the IP address of the client / user requesting the authentication. This attribute is helpful in identifying successfully authenticated clients to be simultaneously authenticated against other systems i.e. like internet filters. Some internet filters providers utilise agent software that can sit on a Windows NPS server and read the logs generated by the NPS service and automatically apply the appropriate internet access policy to the client devices / users at the moment of wireless authentication essentially providing a Single Sign On process.

After attempting to undertake this process at a site that utilises a Netgear WC7600v2 we have come to the conclusion that the WC7600v2 does not provide the Framed-IP-Address. This has been confirmed by reviewing the NPS server logs where Framed-IP-Address radius attribute is 0.0.0.0 for all clients authenticating via the WC7600v2

Thanks to previous advice on this forum, we were able to make contact with Netgear text based support and after sometime the Netgear technician, he was able to confirm that the WC7600v2 does not provide the Framed-IP-Address as part of its radius account response to the NPS (radius) server. This feature maybe included sometime in the future but could not give any ETA on its implementation; he was also able to confirm that other customers of the WC7600 series have requested this feature to be implemented.

What my site is trying to perform is something that is not to complex, I have done it many times via cisco / h3c / Aruba controllers and wireless implementations. These devices are more compliant with the RFC 2866 radius standard than what Netgear equipment is, even though your product information sheet (https://www.netgear.com/images/datasheet/wireless/wirelessmanagement/WC7600v2.pdf) states that the controller is complaint with this spec.

How are we meant to recommend Netgear equipment to clients in enterprise when the device does not standard up against large enterprise network equipment manufactures. I can understand something like "it will be included in the next firmware release" but when something like "No ETA at this time" it makes us feel like recommending to the site management the entire removal the Netgear wireless implementation and going for something "more enterprise".

Do you think if the site invested in Prosafe support agreement it would carry more weight with Netgear in implementing a basic feature like a more extensive implementation of the RFC 2866 accounting standard?

I hope that I do not come across as too negative in this forum thread, but was hoping to provide constructive feedback to help improve your products and the process to improve them.

Peter

[DaneA]

Hi PeterA23,

I moved your post here in the Idea Exchange for Business board in order for the development team to see what needs to be improved on the functionality of the WC7600v2.  

Gave kudos to this post.  Let me inform you that the more kudos given by community members to this post will help as the development team will be reviewing the post that has the most kudos and might be considered.  

Regards,

DaneA

NETGEAR Community Team

[PeterA23]

Can I add a extra posts to this thread at all? There have been new developments at the site.

[PeterA23]

There seems to be some problem copy and pasting text from word into the comment system of the message board.

It post's the post but after a page refresh it vanishes!

[PeterA23]

Thanks for the support DaneA,
 
I have a follow up to my situation at my site with the Netgear wireless. We are currently undergoing a rapid expansion of our wireless infrastructure from the existing 32 AP's up to potentially 40+ AP's due to business growth.
 
As we scale in size our environment has to change along with it, not only do we have to factor in business managed devices and BYOD systems but now we will have to factor in temporary Guest Wireless devices as well for when we undertake general public training sessions for our local community.
 
This has forced us to review and improve our internet filtering, VLAN design, firewalling and wireless infrastructure. The first stage on properly securing our site is to implement enterprise grade wireless authentication and then have that wireless authentication act as the basis for authenticating clients against other network subsystems. The ability for the wireless controller to provide basic wireless accounting information is the very first link in a long chain that will help in simplifying the end user experience at our site.
 
After an intense discussion with my site leadership I.T. has been left with two options,
 
1. Doubling down on the Netgear wireless solution, purchase up another 6 to 10 AP's and hope that Netgear resolve the issue quickly (in the next few weeks).
 
2. Remove the entire Netgear wireless solution at our site, wireless controllers, 30+ AP's and back end switching and moving to an ‘enterprise grade” solution offered by Cisco / HP.
 
From a I.T. / workload / fiscal perspective I would prefer option one as it would save our ROI on I.T. comms infrastructure at our site and put less pressure on I.T. human resources. However, site management have stressed to us that they will not allow technology to be a limiting factor in the development of a flexible, secure and simple to use corporate environment.
 
As some who has recently assumed the mantle of I.T. leadership, I have enough political capital to authorise the procurement of $40 to $60k+ worth of reinvestment of a new comms / network connectivity infrastructure.
 
You have no idea of the of embarrassment the I.T team and I feel when we have secondary service providers representatives from,

1.   http://www.contentkeeper.com
2.   http://www.fortinet.com/products/secure-wifi/wifi-applications/services-appliances.html
3.   http://www.arubanetworks.com/products/security/network-access-control

Actually, laugh in our faces when we inform them of the limitations of our wireless infrastructure and immediately put a stop to negotiations to the implementation of their technology at our site.
 
What should really concern all parties is that our site is considered a pilot site for technological trials that could be used throughout our government department (400+ sites).
 
Netgear, help me help you sell your products by virtue of your products. If that means I need to purchase a ProSupport 3 year support arrangement, we are willing to do so, the previous I.T. management lacked foresight to do this with the money they have invested in your technology at our site.
 
Again, help me help you sell your products or let us all watch them go to our government departments computer-recycling scheme.

In that scenario, everyone loses.
 
Peter

[PeterA23]

Finally got the above message through.

Peter

[PeterA23]

I just wanted to add that this issue has plagued one of your wireless competitors recently, Ubiquiti Wireless devices. They too had issues with Radius accounting limitations and the Frame-IP-Address attribute being missing.

Users of the Ubiquti wireless platform are happy to report that Ubiquti has listened to their feedback and released a beta firmware already resolving this issue and it will go gold by the mid to the end of this month.

Are we going to going to have any movement on this issue from Netgear anytime soon along the lines of one of your major competitors.

Hopefully Netgear's response will be sooner rather than later!

Regards

Peter

[DaneA]

@PeterA23,

Just an update to this.  Your concern has been escalated to the engineering team and its currently being worked on. 

Regards,

DaneA

NETGEAR Community Team

[broadld87]

@DaneA

This is such a basic RADIUS feature of a wireless controller. Could you get the engineering team to contact me as i am having the same issue? Do we have any timescales or ETA's when this will be fixed?

Is it that the controller should be giving this attribute and isn't or was the controller never designed to pass this attribute?

Basically is it or isn't it a bug in the firmware?

As @PeterA23 has said this is usually used for passing on accounting information to an internet filter to apply the correct filtering. It offers a single sign on process.

Thanks

David

[DaneA]

@broadld87,

As per my recent post in this thread, the engineering team is currently working on the issue.  There is no ETA yet on when the fix will be available.  

Regards,

DaneA

NETGEAR Community Team​​​​​​​

[broadld87]

@DaneA

So is the controller meant to pass these RADIUS attributes then? So it is actually a firmware issue with the controller?

Thanks

David