topic is it possible to do machine and user authentication in same Aut in Network Access Control

is it possible to do machine and user authentication in same Authorization profile?

nrafia — Mon, 11 Mar 2019 03:22:36 GMT

Hi,

I want to know is it possible to do machine authenticaiton and user authentication happen at the same time? Some thing like this...

Condition

IF ( wired_802.1x and AD:externalgroup EQUAL dommain computer AND AD:exteranalgroup EQUAL Some_domain_user_group )

Permissions

then Vlan x

Basically i am trying to check a machine is part of domain and user is valid only then he should be able to have full access.

Any help will be of great value.

edwjames — Tue, 30 Apr 2013 10:22:33 GMT

Hi,

IF ( wired_802.1x and AD:externalgroup EQUAL dommain computer AND AD:exteranalgroup EQUAL Some_domain_user_group )

- Not possible

As user and machine authentication occur at different contexts.

ACS cannot verify the both at the same time.

Using MAR, you can, though club the both together and achieve:

"machine is part of domain and user is valid only then he should be able to have full access"

Tips for configuring MAR:

1) Set the client to perform user or computer authentication.

2) Create two rules in authorization, one for user and and one for machine (identity them by using group membership on AD).

3) Enable MAR under the AD configuration page on ACS and set the aging time.

4) In the user rule, customize and use the condition "Was machine authenticated" and set it to true.

Rate if useful

nrafia — Tue, 30 Apr 2013 11:21:56 GMT

It was extremely helpful.

Thanks and rated.