topic Re: Authtication policy can't use EAP-TLS in Network Access Control

Authtication policy can't use EAP-TLS

hamzazidane — Mon, 17 Sep 2018 16:12:08 GMT

Hello,

We have a problem in the configuration of the Authentification Policy, im selecting EAP-TLS in order to force clients to use the certification that i exported from the ISE, but the endpoint can only authenticate using "PEAP (EAP-MSCHAPv2)" even if there is no rule for this protocol.

Thanks to help us.

Re: Authtication policy can't use EAP-TLS

Jason Kunst — Mon, 17 Sep 2018 16:58:35 GMT

have you tried using the default authentication ruleset and simple relying on authorization rules?

Simple examples here in the BYOD guide (you don’t need the BYOD rules) just the one with cert auth minus registration state

See page 25 remove the BYOD is registered and that should work
https://community.cisco.com/t5/security-documents/cisco-ise-byod-deployment-guide/ta-p/3641867

Re: Authtication policy can't use EAP-TLS

paul — Mon, 17 Sep 2018 17:55:09 GMT

in EAP-TLS each client should have their own certificate. You shouldn't be trying to export a certificate from ISE and trying to get the client's to use it to authenticate EAP-TLS. Further more if you are trying something like this you need to export both the cert/private key and ensure the certificate has EKU client auth enabled.