Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

HPE Mist Networking Authentication Proxy: Third-Party Device Support

Follow these steps to use HPE Mist Networking Authentication Proxy to support end-client and management-user authentication into third-party devices such as Cisco IOS devices.

Overview

HPE Mist Networking Access Assurance supports end-client and management-user authentication into third-party devices by leveraging an authentication proxy application running on a HPE Mist Networking Edge platform.

HPE Mist Networking Edge is managed by the cloud and servers as a “gateway” for any third-party managed device that needs to:

  • Perform authentication of end-clients connecting to it (for example, a third-party switch, wireless LAN controller, or access point (AP)

  • Authentication management-users (for example, admin login to a firewall or switch CLI management interface)

To set this up, you'll add your third-party devices as RADIUS clients at the HPE Mist Networking Edge Cluster. The cluster wraps all authentication traffic into a secured RadSec tunnel and sends it to the HPE Mist Networking Access Assurance cloud.

Figure 1: HPE Mist Networking Edge as Auth Proxy—Flow of Connections Flow diagram showing communication in a network system: third-party device uses RADIUS protocol, connects via OOBM to HPE Mist Networking Edge, routes data via RadSec to HPE Mist Networking Access Assurance for secure access management.

Design Considerations

  • HPE Mist Networking Edge can serve as authentication proxy from multiple sites; it is not required to have an edge per site.

  • For redundancy purposes, we recommend to install at least a few HPE Mist Networking Edges in different data centers or points of presense (PoP).

  • HPE Mist Networking Auth Proxy functionality is supported on all HPE Mist Networking Edge platforms. We recommend that you use a dedicated HPE Mist Networking Edge appliance (or VM) for HPE Mist Networking Auth Proxy and avoid combining HPE Mist Networking Auth Proxy with Tunterm or OCProxy functionality.

  • If you are using HPE Mist Networking Edge VM, note that you need only a single network interface and need ME-VM-OC-PROXY to unlock the HPE Mist Networking Auth proxy functionality.

About RADIUS Attributes

  • Based on the configured vendor, HPE Mist Networking Access Assurance automatically sends correct RADIUS Attributes in access-accept response to assign VLANs, roles (firewall filters) and session timeouts.
  • Leverage custom vendor-specific RADIUS attribute labels to send specific attribute back in case of any special use cases.

Add a Third-Party Vendor and Configure an Authentication Policy

  1. HPE Mist Networking Edge Cluster Configuration: Add your third-party vendor as a RADIUS client in your cluster configuration:
    1. From the left menu of the management portal, select Mist Edges.
    2. Under HPE Mist Networking Edge Clusters, click an existing cluster or create a new cluster.
    3. On the cluster page, under Radius Proxy, click Enabled.
    4. Set type as HPE Mist Networking Auth Proxy.
    5. Click Add Client.
    6. Enter the information for the new client:

      • IP Address

      • Shared Secret

      • Vendor

      • Site (optional)

      Configuration interface for Radius Proxy enabled with HPE Mist Networking Auth Proxy type. New client details: IP address 10.7.50.0/24, hidden shared secret, vendor Cisco Wired, site HPE Mist NetworkingAA Test Site.
    7. Click the checkmark at the top of the New Client section to save your settings.
    8. Click Save at the top-right corner of the HPE Mist Networking Edge Clusters page.
  2. Resource Label: Add a label to identify your third-party vendor device as a resource that you can use later in your auth policies.
    1. From the left menu, select Organization > Access > Auth Policies.
    2. At the top of the Auth Policies page, click Create Label.
      Auth Policies interface with description of policy rules evaluation based on match criteria and two buttons: Add Rule and Create Label.
    3. Enter the following information:

      • Label Name—Enter a descriptive label so that you'll recognize this third-party vendor device when you're using this label in your auth policies.

      • Label Type—Select AAA Attribute.

      • Label Values—Select Custom Vendor Specific Attribute.

      • Click Add Attribute, enter a Name and a Value, and then click Create.

      Configuration interface for creating a label with fields for Label Name Cisco CLI Superuser, Label Type AAA Attribute, and Label Values. Buttons Create and Cancel at the bottom.
  3. Auth Policy: Add a rule to identify the users who get authenticated by your third-party device.
    1. At the top of the Auth Policy page, click Add Rule.

      The new rule appears at the top of the rules, numbered. 1.

      Screenshot of a network access management table with columns for number, name showing None, match criteria showing All Users, policy with a green checkmark, and assigned policies showing Network Access Allowed. Yellow-bordered plus icons are visible for adding or editing entries.
    2. Enter the information for this policy:

      • Name—Enter a descriptive name to identify the purpose of this policy.

      • Match Criteria—Click +, and then select the users or user groups that are authenticated by this vendor device.

      • Policy—Leave the green checkmark in place because you want to allow these users to access the resource.

      • Assigned Policies—Click +, and then select the label that you created for your third-party vendor device.

    3. Click Save at the top-right corner of the Auth Policies page.
  4. Add rules for additional vendors as needed.

    This example shows numerous rules for different purposes. You can hover over any resource or user label to see more information.

    User interface for managing authentication policies with columns for policy number, name, match criteria, actions, assigned policies, and hit count. Administrators can define rules for network access based on device types, user groups, and authentication methods.
Configure your third-party vendor device to use HPE Mist Networking Edge as the RADIUS server.

Configuring Your Third-Party Vendor Device

Point your third-party vendor devices towards HPE Mist Networking Edge OOBM IP address as the RADIUS server.

If you're deploying multiple HPE Mist Networking Edges, add each HPE Mist Networking Edge as RADIUS server in failover or load-balance mode, depending on your third-party device support.

Checking Login Records

As part of your verification process for your new auth policy, you can check the status of all login attempts on the NAC Clients page and the NAC Events page.

Figure 2: NAC Clients Page NAC Clients dashboard showing a connected client with site BRQLAB, active state, admin and device authentication, user email vdementyev at juniper dot net, last seen Apr 28 2025 6:43:51 PM CEST, port tty1, matched auth policy Cisco Switch CLI Login - Superusers, NAS vendor cisco-ios.
Figure 3: NAC Events NAC Events dashboard showing network access logs with 503 events categorized as Good, Neutral, and Bad, and detailed event information on the right panel.