I85PREP
⌘ K
ExtremeCloud IQ Site Engine (XIQ-SE) study materials
ExtremeCloud IQ Site Engine (XIQ-SE) study resources

ExtremeCloud IQ Site Engine (XIQ-SE): Policy and Role-Based Access Control (Control, Access Control, and Fabric)

ExtremeCloud IQ Site Engine (XIQ-SE) · Work through your exam, one topic at a time.

All guide sections

Policy and Role-Based Access Control (Control, Access Control, and Fabric)

Domain 5 carries the biggest conceptual load: Extreme Control's authentication and authorisation pipeline, how roles become network policy, and how fabric services and admin permissions bound what a user or endpoint may do.

The Control pipeline

  • Order matters: authentication (802.1X/EAP, MAC authentication, web/captive portal) → assessment (health checks) → authorisation rules evaluated top-down with first match winning → role applied → enforcement.
  • Enforcement means VLAN reassignment, ACL/filter application, or CoA/disconnect (RFC 3576, UDP 3799) forcing reauthentication. The switch must be defined as an enforcement device with a matching RADIUS shared secret.
  • Roles are named outcomes such as Employee, Guest and Quarantine; a default/fail role must exist or failed endpoints land nowhere.

Policy and fabric

  • Policy roles bind profiles defining VLAN, ACL, QoS and NetFlow settings. Control roles reference policy roles, so one admission decision drives both access and network treatment.
  • Fabric Connect uses SPB with L2/L3 VSNs and I-SIDs. Fabric Attach lets an access switch or AP request its I-SID automatically when FA and LLDP are enabled on the port.
  • Admin RBAC is a separate mechanism: user groups grant read or read/write per module and can be scoped by device group or site, while Control domains split enforcement devices and rules between teams.

Worked example

A contractor laptop lands on the Employee VLAN. The MAC matches a generic Accept rule for a known OUI sitting above the contractor rule, so first-match logic ends evaluation before the specific rule is read. Move the specific Deny/Quarantine rule above the generic Accepts, save, and send CoA so existing sessions re-evaluate; without working CoA the change only affects new authentications.

Traps that cost marks

  • Rule ordering with broad catch-alls at the top.
  • RADIUS shared-secret mismatch producing silent rejects.
  • CoA blocked by firewall or sourced from the wrong interface.
  • Role VLAN not permitted on the uplink trunk.
  • ACL applied in the wrong direction.
  • FA enabled on the switch but LLDP disabled on the port.
  • Treating admin RBAC and Control authorisation as the same mechanism.