topic Re: Ability to have computer or user auth in Network Access Control

Ability to have computer or user auth

virtualpedia — Mon, 21 Sep 2020 21:24:28 GMT

I've been told this isn't possible but want to check. Planning to deploy ISE 2.7. For the same SSID, is it possible to use computer auth for some clients and user auth for different clients?

For example, our domain joined windows 10 machines, I'd prefer to use computer auth. This helps with group policy running and allows a network connection prior to windows login. I'd like the same for domain macOS devices.... For our iPADs, they'd need user auth, as they won't have the certificate.

We don't have anyconnect client

Re: Ability to have computer or user auth

Mohammed al Baqari — Mon, 21 Sep 2020 23:38:02 GMT

It is possible, you can create rules based on device profile and
authentication will be as you need. So w10 and mac profiled machines can
use machine auth.

Use device sensors on the switches to send attributes to ISE for profiling.

***** please remember to rate useful posts

Re: Ability to have computer or user auth

virtualpedia — Tue, 22 Sep 2020 00:25:58 GMT

@Mohammed al Baqari

would that require that I have Plus licensing? I only will have base licensing to start

Re: Ability to have computer or user auth

balaji.bandi — Tue, 22 Sep 2020 11:50:13 GMT

yes you need for additional requirement :

here is good license document explained - what feature cover based on the model

https://content.cisco.com/chapter.sjs?uri=/searchable/chapter/content/en/us/td/docs/security/ise/1-4/admin_guide/b_ise_admin_guide_14/b_ise_admin_guide_14_chapter_0111.html.xml

Re: Ability to have computer or user auth

thomas — Tue, 22 Sep 2020 16:15:32 GMT

Both are easily possible.

See ISE Authentication and Authorization Policy Reference > Microsoft Active Directory Groups Authorizations for examples of each.