https://community.cisco.com/t5/network-access-control/certificate-auto-enrollment-not-working-in-closed-mode-for-user/m-p/3894465#M471248 <P>Hi everyone,</P><P>We've been struggling in this situation for a few days.</P><P>We have the following scenario for our ISE deployment:</P><P>User and Machine Authentication with EAP Chaining, using Certificates for both, Supplicant is Anyconnect NAM.&nbsp;</P><P>We are in PoC stage in Authentication open mode and we want to change to closed mode very soon. We are using auto-enrollment for certificates deployment, but it is failing in closed mode, machine authentication is correct but new users cannot get the user certificate and authentication fails.</P><P>We have machines that will be used by more than one user anytime. How can we do for the auto-enrollment work in this cases? Please your help with this issue.</P> Mon, 22 Jul 2019 01:11:06 GMT reynaldolopeza 2019-07-22T01:11:06Z https://community.cisco.com/t5/network-access-control/certificate-auto-enrollment-not-working-in-closed-mode-for-user/m-p/3894465#M471248 <P>Hi everyone,</P><P>We've been struggling in this situation for a few days.</P><P>We have the following scenario for our ISE deployment:</P><P>User and Machine Authentication with EAP Chaining, using Certificates for both, Supplicant is Anyconnect NAM.&nbsp;</P><P>We are in PoC stage in Authentication open mode and we want to change to closed mode very soon. We are using auto-enrollment for certificates deployment, but it is failing in closed mode, machine authentication is correct but new users cannot get the user certificate and authentication fails.</P><P>We have machines that will be used by more than one user anytime. How can we do for the auto-enrollment work in this cases? Please your help with this issue.</P> Mon, 22 Jul 2019 01:11:06 GMT https://community.cisco.com/t5/network-access-control/certificate-auto-enrollment-not-working-in-closed-mode-for-user/m-p/3894465#M471248 reynaldolopeza 2019-07-22T01:11:06Z https://community.cisco.com/t5/network-access-control/certificate-auto-enrollment-not-working-in-closed-mode-for-user/m-p/3894467#M471251 <P>I would suggest the following:</P> <UL> <LI>In NAM, create two networks -- one for machine-auth only and the other for machine-auth + user-auth. The users need allowed to select and fall back to machine-auth.</LI> <LI>In ISE, give limited access for auto-enroll when machine-auth only. And, give full access when both auths succeeded.</LI> </UL> Mon, 22 Jul 2019 01:22:05 GMT https://community.cisco.com/t5/network-access-control/certificate-auto-enrollment-not-working-in-closed-mode-for-user/m-p/3894467#M471251 hslai 2019-07-22T01:22:05Z