topic Re: ISE BYOD Certificates Question in Network Access Control

ISE BYOD Certificates Question

mikejhathaway — Tue, 04 Jul 2017 20:35:53 GMT

Hi, I am new to ISE so please excuse me if this is a basic question.

I am trying to configure ISE for BYOD using certificates, I have added the external CA and created a certificate template but the template doesn't show up when I configure the enrollment portal, what have I missed??

Thanks in advance!

Mike

Re: ISE BYOD Certificates Question

Sloanstar — Fri, 14 Jul 2017 16:47:38 GMT

There's a native supplicant profile where you select the certificate template. It's in Policy Results for Client Provisioning.

Re: ISE BYOD Certificates Question

hslai — Sat, 15 Jul 2017 01:45:23 GMT

ISE certificate provisioning portals are for ISE internal CA only. Thus, only the certificate templates using ISE internal CA are available for selection.

Re: ISE BYOD Certificates Question

Sloanstar — Sat, 15 Jul 2017 02:41:49 GMT

I'm pretty sure you can configure a SCEP template as well in order to go external.

It's been a while since we did it that way. We've since moved to the ISE CA for ease of use and to keep the PKI trust separate from BYOD. But I know we were getting certs created by an internal Microsoft server at one point.

Re: ISE BYOD Certificates Question

hslai — Sat, 15 Jul 2017 02:51:17 GMT

I agreed the wording is a bit unclear. For BYOD NSP, yes, external SCEP/CA would work.

However, I am pretty sure he meant an ISE Certificate Provisioning Portal by the "enrollment" portal. ISE certificate portals are similar to AD's /certsrv/ so they do not use SCEP to issue the certificates.

Nonetheless, thanks for your contributions.