topic Re: ACS 5.2 allow only specified client cert in Network Access Control

ACS 5.2 allow only specified client cert

Dominic Stalder (old profile) — Mon, 11 Mar 2019 01:25:22 GMT

Hi there

I would like to implement a policy, where I specify which client cert (CN name) is allowed. Let's say we have 2 SSID's and 2 different client certs:

- client1.domain.com should only be allowed to connect to SSID1

- client2.domain.com should only be allowed do connect to SSID2

Both SSID's use machine certs for EAP-TLS and both certs are issued by the same CA cert. Does anybody know how to specify this in ACS 5.2?

Thanks in advance and best regards

Dominic

ACS 5.2 allow only specified client cert

jrabinow — Wed, 21 Sep 2011 16:20:21 GMT

This should be possible

You can make conditions based on the CN name as follows:

- Create a custom conditon. Policy Elements > Session Conditions > Custom. Select "Certificate Dictionary" and attribute "Common Name". Give it a name. Once you do this you can create a condition based on this in policies

Do you have a RADIUS attribute to extract the SSID? Is it in the "“Called-Station-ID" field

Then create authorization policy:

- If "Common Name" equals "client1.domain.com" and "SSID" equals SSID1 then "Allow Access"

- If "Common Name" equals "client1.domain.com" and "SSID" equals "Any" then "Deny Access"

- If "Common Name" equals "client2.domain.com" and "SSID" equals SSID2 then "Allow Access"

- If "Common Name" equals "client2.domain.com" and "SSID" equals "Any" then "Deny Access"

ACS 5.2 allow only specified client cert

Dominic Stalder (old profile) — Wed, 21 Sep 2011 16:53:24 GMT

Hi jrabinow

thanks a lot for your very quick response - I will try this next week when I am onsite again and will update this thread.

I extract the SSID with a "end station filter" (link to the thread where I got the information from:

https://supportforums.cisco.com/message/3231646).

Best regards

Dominic

Re: ACS 5.2 allow only specified client cert

ewood2624 — Thu, 22 Sep 2011 05:02:28 GMT

Why not use a single SSID and use dynamic vlan assignments to allow only certain clients to go to certain wlans? You can use the end station filters as a Mac list and set up a policy to restrict them to certain wlans.

Sent from Cisco Technical Support iPad App