topic ACS with AD-with twin authentication in Network Access Control

ACS with AD-with twin authentication

nikhilcherian — Mon, 11 Mar 2019 01:34:51 GMT

Hi Gurus

I want to integrate my ACS 5.1 with AD, My request is to check for the machine authentication first. If the machine authentication passes the client username/password should be validated and client should be put in vlan X . If the machine authentication fails, the client username/password should be validated. If the authentication passes the client should be put in vlan Y

Let me know if this is possible

Thanks

NikhiL

ACS with AD-with twin authentication

Tarik Admani — Sat, 26 Nov 2011 16:51:49 GMT

Nikhil,

You can setup a condition in your authorization policy and check if the machine authentication was performed and base your result off this condition.

Here is a guide that fits your questions:

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.1/user/guide/users_id_stores.html#wp1235978

thanks,

Tarik Admani

ACS with AD-with twin authentication

nikhilcherian — Sat, 26 Nov 2011 17:04:43 GMT

Hi Tarik,

Thansks for the reply.

below is a line i found in the doc.

Administrator can configure whether or not MAR is enabled in the AD settings page. However for MAR to work the following limitations must be taken into account:

–Machine authentication must be enabled in the authenticating protocol settings

Does this say the authenticator should enable mac-auth

Thanks

NikhiL

ACS with AD-with twin authentication

Tarik Admani — Sun, 27 Nov 2011 03:48:34 GMT

The wording on this is a little tricky, this means for machine authentication to work (PEAP or EAP-tls) you have to allow the protocol in the rule for it to work on the ACS side. When you click the on the service selection rule for default network access, you will the different protocol boxes checked.

Hope this helps,

Tarik Admani