topic Machine authentication for IOS routers, switches in Network Access Control

Machine authentication for IOS routers, switches

susreeni — Wed, 29 Nov 2017 04:03:01 GMT

Hi team,

I’m working with a customer who has a requirement to authenticate routers against ISE using digital certificates.

They want to ensure that any network devices such as IOS routers, switches are subjected to machine authentication using identity certificates pre-installed on the device, when these devices are deployed to their network.

In essence, the routers and switches in their deployment should authenticate themselves before being granted network access.

This requirement of theirs stems from the fact that the entire solution is being designed for the defense vertical.

Any insight on how this requirement can be met; ISE or otherwise will be much appreciated !

Re: Machine authentication for IOS routers, switches

ognyan.totev — Wed, 29 Nov 2017 07:54:00 GMT

I dont get why the customer want this . This devices are usually add in to ise . In network device list . And for some reason authentication fail it will it will DENY ACCESS. If NAD is in deny access all endpoints will not able to have access. I think this is not recommend .And usually all Radius and Tacacs are included in triple AAA model .

Here in community we have some gurus and they will answer you but as i mention this is not good .

Re: Machine authentication for IOS routers, switches

kthiruve — Fri, 01 Dec 2017 06:38:07 GMT

Are you talking about NEAT. Please take a look at this doc.

NEAT Configuration Example with Cisco Identity Services Engine - Cisco

-Krishnan

Re: Machine authentication for IOS routers, switches

susreeni — Fri, 01 Dec 2017 06:49:33 GMT

Hi Krishnan,

NEAT isn't the scenario that the customer is looking at.

From what I understand, NEAT is a 802.1x scenario where both the authenticator (IOS switch) as well as the supplicant mutually authenticate each other rather than only the supplicant being authenticated, which is normally the case.

The requirement is simply one where IOS routers, IOS switches themselves will be supplicants to the network with certificates being their 802.1x credentials (Perhaps EAP-TLS needs to be the 802.1x method?).

Regards,

Sundar

Re: Machine authentication for IOS routers, switches

kthiruve — Fri, 01 Dec 2017 07:09:09 GMT

You are talking about NDAC that establishes Trustsec domain boundary.

Here is the doc for that explains nicely all about NDAC

https://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise/design-zone-security/how_to_intro_macsec_ndac_guide.pd…

-Krishnan