topic CWA chaining in Network Access Control https://community.cisco.com/t5/network-access-control/cwa-chaining/m-p/3585056#M518976 <HTML><HEAD></HEAD><BODY><P>Hello team,</P><P></P><P>We have a customer that requires to check both device certificate (to prevent access of non-corporate laptops) and user identity (username and password). They don't have AD and would like to store the identity in the internal ISE DB. One of the possible solutions discussed was to chain EAP-TLS and CWA but we still have a doubt regarding group information. The attribute we use for that is CWA_ExternalGroups but would it be populated with user group if internal users DB is used for the CWA auth instead of LDAP / AD?</P><P></P><P>Thanks,</P><P>Viktor Kirchev</P></BODY></HTML> Wed, 20 Dec 2017 15:11:10 GMT vkirchev 2017-12-20T15:11:10Z CWA chaining https://community.cisco.com/t5/network-access-control/cwa-chaining/m-p/3585056#M518976 <HTML><HEAD></HEAD><BODY><P>Hello team,</P><P></P><P>We have a customer that requires to check both device certificate (to prevent access of non-corporate laptops) and user identity (username and password). They don't have AD and would like to store the identity in the internal ISE DB. One of the possible solutions discussed was to chain EAP-TLS and CWA but we still have a doubt regarding group information. The attribute we use for that is CWA_ExternalGroups but would it be populated with user group if internal users DB is used for the CWA auth instead of LDAP / AD?</P><P></P><P>Thanks,</P><P>Viktor Kirchev</P></BODY></HTML> Wed, 20 Dec 2017 15:11:10 GMT https://community.cisco.com/t5/network-access-control/cwa-chaining/m-p/3585056#M518976 vkirchev 2017-12-20T15:11:10Z Re: CWA chaining https://community.cisco.com/t5/network-access-control/cwa-chaining/m-p/3585057#M518977 <HTML><HEAD></HEAD><BODY><P>The CWA identity is assigned the identity used to perform CWA.&nbsp; It is that value which would be used for group lookup.&nbsp; As the common use case is to perform lookup to one of the defined external ID stores, so not sure if specific testing performed for InternalUser&gt;IdentityGroup, but would suggest trying it.</P></BODY></HTML> Wed, 20 Dec 2017 16:21:17 GMT https://community.cisco.com/t5/network-access-control/cwa-chaining/m-p/3585057#M518977 Craig Hyps 2017-12-20T16:21:17Z