topic Re: ISE authentication WPA2 in Network Access Control

ISE authentication WPA2

adamgibs7 — Fri, 21 Feb 2020 18:37:59 GMT

Dears

i dont know what i am asking is correct but i am confused,

I want to authenticate users via WPA2 pre-shared key on SSID but these should be only apple users and from windows AD particular group,

Is it possible ??

Re: ISE authentication WPA2

Rob Ingram — Sat, 04 Nov 2017 20:55:11 GMT

Hi,

If you want to allow only users from an AD group then you will need to use WPA2 Enterprise NOT a pre-shared key. If you use a pre-shared key anyone on any device can type use thus without requiring to authenticate to the SSID,

HTH

Re: ISE authentication WPA2

adamgibs7 — Sat, 04 Nov 2017 21:11:23 GMT

thanks for the reply,

so you mean to say 802.1X authentication on AD ??? my goal is to separate apple IPAD users from iphone and android devices, how i can achieve that ,, what conditions i can choose to make IPAD unique, if it is difficult to separate ipad and iphone then no problem atleast i will deny android

Re: ISE authentication WPA2

Rob Ingram — Sat, 04 Nov 2017 21:08:08 GMT

Yes, if you want to authenticate against AD you'd use 802.1x

Re: ISE authentication WPA2

adamgibs7 — Sat, 04 Nov 2017 21:12:31 GMT

thanks again for the quick reply

my goal is to separate apple IPAD users from iphone and android devices, how i can achieve that ,, what conditions i can choose to make IPAD unique, if it is difficult to separate ipad and iphone then no problem atleast i will deny android

Re: ISE authentication WPA2

Rob Ingram — Sat, 04 Nov 2017 21:16:28 GMT

You can use ISE profiling to determine the OS of the device - therefore determine if it's an apple iphone/ipad or android device. You can then create authorisation rules to permit/deny depending on the type of device

Re: ISE authentication WPA2

adamgibs7 — Sat, 04 Nov 2017 21:23:18 GMT

Dear

recently i created a condition of wireless dot1.X and below the attributes such as

windows AD particular manager group
logical profiles contains ipad and iphone

but the problem is if the manager from the particular group gets his personal android he is able to authenticate and he gets the ip address,

when i see the authorization policy it falls proper to which i created then why it is accepting from the android.

Re: ISE authentication WPA2

adamgibs7 — Mon, 06 Nov 2017 20:02:42 GMT

Dear Expert,
how i can troubleshoot such problem