topic Re: Using different CAs for different devices' cert based authentication via ISE in Network Access Control

Using different CAs for different devices' cert based authentication via ISE

wingai — Wed, 02 May 2018 08:04:35 GMT

Hi there, Customer has two separate sets of devices that they want to implement certificated based authentication via ISE. One is their users' mobile devices (BYOD scenario). The other is their IoT devices (Yes, these devices are cert ready). They want to use two different CAs (AD CA for users' mobile device while ISE CA for IoT device). Is this possible and how to do that? Thanks. - William

Re: Using different CAs for different devices' cert based authentication via ISE

ognyan.totev — Wed, 02 May 2018 08:59:51 GMT

Yes it is ,look here ISE Certificate Authority (CA)

Re: Using different CAs for different devices' cert based authentication via ISE

smashash — Wed, 02 May 2018 09:08:24 GMT

Yes. it is possible.

first of all you need to import the Root CA (issuer CA) into ISE ( under Trusted Certificate page)

You need create two rules under policy for AD CA for users' mobile device and IoT devices.

ISE has several attributes to differentiate these two flows ( e.g. BYODRegistration flag for BYOD flow or using Certificate (Issuer CA) attributes,device location or group ...)

here is an example:

YYes

HTH,