topic Re: Cisco ISE protocols for ldap and Windows wireless client in Network Access Control

Cisco ISE protocols for ldap and Windows wireless client

Mathieu Sturm — Mon, 11 Mar 2019 04:02:31 GMT

Only the protocols below are supported by ise in combination with ldap identity sources.

EAP-GTC, PAP, EAP-TLS, PEAP-TLS.

Mac OS devices seem to be able to use these but Windows users seem to be having problems. How should windows users connect with ise that only uses ldap?

Re: Cisco ISE protocols for ldap and Windows wireless client

Nicholas Poole — Mon, 28 Oct 2013 10:53:14 GMT

The Windows supplicant supports EAP-TLS when you select certificates as the auth method. (you of course needs client side certs issued to windows user to use EAP-TLS though)

Re: Cisco ISE protocols for ldap and Windows wireless client

Mathieu Sturm — Mon, 28 Oct 2013 12:31:18 GMT

That doesn't seem to be very user friendly

Re:Cisco ISE protocols for ldap and Windows wireless client

Tarik Admani — Mon, 28 Oct 2013 12:52:00 GMT

You can use the anyconnect network access manager. Just out of curiosity why ldap over joining ise to AD?

Sent from Cisco Technical Support Android App

Re: Cisco ISE protocols for ldap and Windows wireless client

Mathieu Sturm — Mon, 28 Oct 2013 13:30:57 GMT

Do you still need the certificates then with the network access manager? We need to strip of everything after the @ sign. I know you can connect with an AD through LDAP external identity source but because of our complicated AD structure this isn't possible.

Re: Cisco ISE protocols for ldap and Windows wireless client

Tarik Admani — Mon, 28 Oct 2013 16:34:06 GMT

Mathieu,

Take a look at the user guide for NAM -

http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect30/administration/guide/ac04namconfig.html

You will see the protocols support like GTC that should allow you not to have to deploy certs.

Thanks.

Tarik Admani
*Please rate helpful posts*

Cisco ISE protocols for ldap and Windows wireless client

Mathieu Sturm — Tue, 29 Oct 2013 13:26:07 GMT

I can't ask the users to install something. The reason I use LDAP is because I need to strip of some data in the username starting from the @ sign. Unfortunately LDAP is the only way to go to do this isn't it?