topic Migrating EAP-MSCHPv2 to EAP-TLS in Network Access Control https://community.cisco.com/t5/network-access-control/migrating-eap-mschpv2-to-eap-tls/m-p/2067462#M157597 <HTML><HEAD></HEAD><BODY><P>By default ACS has peap and eap-tls authentication enabled and is part of the proposed eap types. Just remember that the certificate will have to uploaded to the ACS trusted certificate store, and once you configure the certificate authentication profile, you can map that into a Identity Sequence store, so that ACS will check the cert, and if one isnt provided it can fall back to password authenticate against AD.<BR /><BR />Thanks,<BR /><BR />Tarik Admani<BR />*Please rate helpful posts*</P></BODY></HTML> Fri, 26 Oct 2012 19:20:48 GMT Tarik Admani 2012-10-26T19:20:48Z Migrating EAP-MSCHPv2 to EAP-TLS https://community.cisco.com/t5/network-access-control/migrating-eap-mschpv2-to-eap-tls/m-p/2067461#M157574 <P>Hi</P><P></P><P>I have a customer who has deployed ACS for 802.1x against active directory for their wired Cisco switch infrastructure using EAP-MSCHAPv2. Now they would like to change to EAP-TLS but if they just switch the client PCs would be locked out and could get a certificate pushed out to them from AD.</P><P>Can ACS be set to allow both autentication methods during the migration phase ? I know it supports negotiation of the EAP type but its a while since I played with ACS and dont have one to hand to try it with.</P><P></P><P>Thanks</P> Mon, 11 Mar 2019 02:43:36 GMT https://community.cisco.com/t5/network-access-control/migrating-eap-mschpv2-to-eap-tls/m-p/2067461#M157574 Patrick Colbeck 2019-03-11T02:43:36Z Migrating EAP-MSCHPv2 to EAP-TLS https://community.cisco.com/t5/network-access-control/migrating-eap-mschpv2-to-eap-tls/m-p/2067462#M157597 <HTML><HEAD></HEAD><BODY><P>By default ACS has peap and eap-tls authentication enabled and is part of the proposed eap types. Just remember that the certificate will have to uploaded to the ACS trusted certificate store, and once you configure the certificate authentication profile, you can map that into a Identity Sequence store, so that ACS will check the cert, and if one isnt provided it can fall back to password authenticate against AD.<BR /><BR />Thanks,<BR /><BR />Tarik Admani<BR />*Please rate helpful posts*</P></BODY></HTML> Fri, 26 Oct 2012 19:20:48 GMT https://community.cisco.com/t5/network-access-control/migrating-eap-mschpv2-to-eap-tls/m-p/2067462#M157597 Tarik Admani 2012-10-26T19:20:48Z