Dual authentication without EAP Chaining/EAP FastV2 using ISE & Meraki

c.newcombe — Wed, 07 Feb 2018 15:57:00 GMT

Hi,

I am looking to deploy a Meraki switch and AP network but the client wants to be able to authenticate both machine and user (equivalent to EAP Chaining). We are looking to deploy ISE 2.2 or 2.3 as the authentication server. The client does not want to deploy any additional software to their machines but would accept a temporary agent if necessary. Are there any suggestions on how this can be achieved in a Meraki environment.....

Re: Dual authentication without EAP Chaining/EAP FastV2 using ISE & Meraki

Jason Kunst — Wed, 07 Feb 2018 16:16:33 GMT

The network gear doesn’t matter. Either is supports dot1x or it doesn’t. There is no temporary agent that does EAP chaining. Its part of the anyconnect NAM (which is a persistent supplicant). There is also the TEAP standard that we are asking Microsoft and Apple to implement in their supplicants. Please have your customer request this through them.

What about doing Machine & User Auth with Microsoft native supplicant using MAR caching? Keep in mind this doesn't work with Fast USER Switching (known microsoft issue of only authenticating the first user on dot1x and not supplicant)

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-software/200388-Understanding-Machine-Access-Restriction.html

https://www.cisco.com/c/en/us/support/docs/lan-switching/8021x/116516-problemsolution-technology-00.html

Some partners berbee like do advocate machine auth only i believe and then you can do what is called CWA chaining.

topic Re: Dual authentication without EAP Chaining/EAP FastV2 using ISE & Meraki in Network Access Control

Dual authentication without EAP Chaining/EAP FastV2 using ISE & Meraki

Re: Dual authentication without EAP Chaining/EAP FastV2 using ISE & Meraki