topic Re: Cisco ISE 2.4 Authentication Problem in Network Access Control

Cisco ISE 2.4 Authentication Problem

bagiyevramin — Wed, 06 Mar 2019 06:23:11 GMT

Hi, I am new in Cisco ISE.

My Cisco ISE version is 2.4.0.357

In my environment, there are a lot of thin clients which is not in the domain and they will not be in the domain in future. I want these thin clients to join network after passing 802.1X.

How can I achieve this goal with the help of Cisco ISE?

Please help.

Re: Cisco ISE 2.4 Authentication Problem

bern81 — Wed, 06 Mar 2019 08:11:49 GMT

Hi,

You could do EAP-TLS authentication for those clients by creating certificates for them.

Create a CAP (certificate authentication Profile) in the ISE that will check the CN filed of the certificate or SAN-DNS field

BUT don't perform any AD lookup in the CAP.

use this CAP in the authentication policy.

Then in the authorization policy you can match on certificate fields as conditions to apply policies like VLAN/DACL ....

ORR less secure method use MAB authentication by adding the MAC addreses to those devices into the ISE database or use an external database like LDAP.

I hope this helps.

Please rate.

Re: Cisco ISE 2.4 Authentication Problem

bagiyevramin — Wed, 06 Mar 2019 13:10:47 GMT

bern81, thank you for the reply. As I said I am new in Cisco ISE.
Is there any helpful documentation about what you wrote (EAP_TLS Authentication). Because I confused among documentations.

Re: Cisco ISE 2.4 Authentication Problem

Mike.Cifelli — Wed, 06 Mar 2019 16:46:57 GMT

@bern81 posted helpful information. IMO, unless you are familiar with PKI and/or if you dont already have an internal PKI setup I would recommend moving forward with the mab solution. Obviously this depends on your requirements, but it will be much easier to manage. If you are interested in 8021x with eap-tls you can find some good video tutorials here:
http://www.labminutes.com/video/sec
HTH!

Re: Cisco ISE 2.4 Authentication Problem

bagiyevramin — Thu, 07 Mar 2019 07:03:11 GMT

@Mike.Cifelli thank you for the reply and link. I'll watch all these videos. Thank you.

Re: Cisco ISE 2.4 Authentication Problem

bern81 — Thu, 07 Mar 2019 08:32:41 GMT

Hi,

I know this is a little bit complicated as Mike mentioned, you need to have a PKI that signs certificates and u need to configure EAP-TLS on the windows devices.
Check on internet as well about CAP configuration in ISE.

Re: Cisco ISE 2.4 Authentication Problem

bagiyevramin — Sun, 10 Mar 2019 08:19:13 GMT

@bern81 thank you for the reply, I'll check.