Remove "host/" prefix added to 802.1x user

[enigma27]

I have a deployment where machine certificates are deployed and used for 802.1x authentication to an SSID. This machine certificate is created using the device's asset tag. For example asset001.mydomain.co.uk.

Authentication to the SSID works fine. But when looking at clients authenticated, I notice that the Meraki dashboard has a prefix of "host/" in front of the 'User' field. So instead of the Meraki dashboard showing the 'user' field as 'asset001.mydomain.co.uk' (which is the CN of the machine certificate), it shows it as 'host/asset001.mydomain.co.uk'.

Is there a way to remove or disable the addition of this "host/" prefix?

[alemabrahao]

This prefix is typically added by the server during the authentication process, not by the Meraki dashboard itself.

[alemabrahao]

What Radius server are you using?

[enigma27]

Cisco ISE.

[alemabrahao]

As far as I remember, this is the standard when you use certificate authentication.

[enigma27]

It doesn't seem to be a standard thing with certificate authentication from what I can see. After reviewing further, it appears it only adds this prefix to Windows endpoints. Macs appear with just the hostname as expected. Both Windows and Macs are on the same domain with certs deployed from the same CAs.

The reason this is causing me an issue is that the Syslog messages generated by the APs are sent to another appliance that identifies the asset based on the 'User' field. This appliances doesn't seem to be able to recognise any text after the "host/" so it is simply recognising multiple assets as the same 'User' called 'host'.

[alemabrahao · Accepted solution]

Take a look at this discussion.

Solved: WIndows 10 adding "host/" to the username during eap-tls and or peap - Cisco Community

[alemabrahao]

If you want to strip the "host/" prefix before sending the request to AD, then you can perform this manipulation in the ISE External identities menu option:

[enigma27]

Thanks. This should be what I need.

[RaphaelL]

The dashboard is displaying "host/" in the field "description" because it is seen in the RADIUS packets. 

I couldn't capture the EAP packets yet. So I'm not sure if the Windows client is actually sending this or the Meraki MS/MR are adding this. Will keep you posted.

[RaphaelL]

This is a field sent by the Windows workstation. Meraki has nothing to do with it. 

alemabrahao has suggested some nice tips.