topic Native Supplicant Profile With Multiple SSIDs Using EAP-TLS Auth in Network Access Control

Native Supplicant Profile With Multiple SSIDs Using EAP-TLS Auth

Scott Gillies — Wed, 14 Mar 2018 18:25:46 GMT

I have a Native Supplicant Profile that supports the deployment/on-boarding of a client device with 2 SSIDs both using EAP-TLS authentication.

On-boarding requires the client to initially authenticate via their Active Directory credentials which then pushes them to Client Provisioning.

When the on-boarded client tries to connect to either SSID it always performs EAP-TLS using the same certificate.

How do I get the client device to use the correct certificate with the correct SSID?

Thanks in advance.

Re: Native Supplicant Profile With Multiple SSIDs Using EAP-TLS Auth

Jason Kunst — Wed, 14 Mar 2018 19:27:03 GMT

The clients are set to use a certificate for the specific profile and ssid.

AFAIK We don’t support having multiple certs deployed as part of one profile

Re: Native Supplicant Profile With Multiple SSIDs Using EAP-TLS Auth

hslai — Thu, 15 Mar 2018 03:52:11 GMT

If this is about Windows Native Supplicant, then I do not believe it ties the network profiles with particular personal certificates so that might be expected behavior.

Re: Native Supplicant Profile With Multiple SSIDs Using EAP-TLS Auth

Scott Gillies — Thu, 15 Mar 2018 09:36:35 GMT

Please see image, appropriately redacted, of the Native Supplicant Profile template. It allows you to add multiple SSIDs (Wireless Profiles) to the profile template using (I assume) different Certificate Templates, in this case we have 2 different EAP Templates (names not fully shown).

So what does "Multiple SSIDs" imply?

Re: Native Supplicant Profile With Multiple SSIDs Using EAP-TLS Auth

hslai — Thu, 15 Mar 2018 16:47:16 GMT

Apple configuration profiles for Wireless on iOS and macOS allow multiple SSIDs and, if cert-based auth, each with its own certificate. The same might not work well on other client OS's.