topic Re: Logoff on a RDP machine finishes 802.1x session/Default VLAN in Network Access Control

Logoff on a RDP machine finishes 802.1x session/Default VLAN

network_geek1979 — Tue, 01 Nov 2022 09:14:10 GMT

Team, an issue we are facing with one of our client machines.

We have some end user who try an RDP to a machine in the office network.
However, in our case for a successful authentication to take place the machine must show the user certificate to the network.

Till the user does an RDP certificate authentication does not work, and the machine gets an IP address on the Guest VLAN till then.
Any suggestions on getting over this behavior?

Regards,

Re: Logoff on a RDP machine finishes 802.1x session/Default VLAN

Dustin Anderson — Tue, 01 Nov 2022 14:41:17 GMT

Not a helpful answer, but the issue is Microsoft doesn't register an RDP session as a login, so the networks will still see it as a machine. I don't know of a way around it without some installed program to force it.

Here we have Citrix and a receiver app installed on computers so when they remote in it triggers it as a login.

Re: Logoff on a RDP machine finishes 802.1x session/Default VLAN

ahollifield — Tue, 01 Nov 2022 15:28:04 GMT

AnyConnect NAM solves this problem.

Re: Logoff on a RDP machine finishes 802.1x session/Default VLAN

Dustin Anderson — Tue, 01 Nov 2022 15:45:41 GMT

AnyConnect NAM causes more problems than it solves lol.

Re: Logoff on a RDP machine finishes 802.1x session/Default VLAN

Aref Alsouqi — Tue, 01 Nov 2022 16:44:19 GMT

As already mentioned, you would need to install AnyConnect NAM or you can also use TEAP to fix that issue. Essentially what you need in this case is EAP chaining, otherwise when the user tries to RDP to the remote host, the session will still be previous one that has been already authenticated and authorized. AnyConnect NAM require buying its licenses as well as deploying the software on all the hosts that would be RDP'ed. However, TEAP is much simpler and has no extra cost, the only thing to keep in mind with TEAP is that you need the Windows 10 build 2004, otherwise you won't see it as an option in the NIC dot1x tab.