topic ISE support for Machine Certificate plus User authentication in Network Access Control

ISE support for Machine Certificate plus User authentication

tiryan — Wed, 09 Dec 2020 01:20:38 GMT

I found the following that was posted here many years ago.

Is this post still valid? Is EAP Chaining with AnyConnect client the only way to accomplish this?

OR has something changed in ISE to support 2 authentications from one device?

Cut from previous post.

I don't believe that this is possible and it is due to the limitations of the native windows supplicant where can do either one of the following:

1. User authentication

2. Machine authentication

3. Machine or user authentication

Machine+User authentication can only be accomplished with EAP-Chaining which is only supported by AnyConnect.

Re: ISE support for Machine Certificate plus User authentication

Damien Miller — Wed, 09 Dec 2020 01:51:28 GMT

ISE 2.7 release also provided the option for EAP-TEAP as an alternative to EAP-Chaining with NAM. As of today, only Windows supports EAP-TEAP, and of that only the Windows 10 2004+ (May 2020 release) 2H builds or newer.

https://community.cisco.com/t5/security-documents/teap-for-windows-10-using-group-policy-and-ise-teap/ta-p/4134289

There were a couple open bugs in 2.7 for TEAP, but I believe patch 3 was going to address them.

Re: ISE support for Machine Certificate plus User authentication

nspasov — Wed, 09 Dec 2020 05:37:12 GMT

In addition to the excellent answer from Damien, you can also do EAP+CWA chaining where machines that successfully authenticate with machine certificates are punted through the Central Web Authentication flow for user based authentication.

Thank you rating helpful posts!

Re: ISE support for Machine Certificate plus User authentication

tiryan — Wed, 09 Dec 2020 14:46:35 GMT

Thank you to both of you for the quick responses. Do you know what version of ISE is needed to support the EAP+CWA chaining?

Re: ISE support for Machine Certificate plus User authentication

nspasov — Wed, 09 Dec 2020 17:20:26 GMT

I really don't recall but this has been supported for a while...probably since ISE 2.0 days.

Thank you rating helpful posts!