topic Re: Find a condition to authenticate to the correct domain with TEAP in Network Access Control

Find a condition to authenticate to the correct domain with TEAP

REJR77 — Thu, 25 Nov 2021 14:19:11 GMT

Hi,

I have several AD domains on my ISE deployment
Depending on the AD domain, the Authentication Policy to access the network may change

- For some domains, we use EAP TLS only (machine Authentication only)
- And for 1 domain we use TEAP (machine certificate + username/pwd for user)

In the Authentication Policy, I can make a condition to match the Certificate Issuer and then check in the right Certificate Profile for Authentication

Is it possible for TEAP authentication to find a condition that would authenicate to the specified Joint Point and not asking to all the joint points? (we can not use network device as a differenciator)

Actually my concern is to send the Authentication to the correct Authentication server, without the need to go through each Join Point.

Thanks for any idea

Re: Find a condition to authenticate to the correct domain with TEAP

Arne Bier — Thu, 25 Nov 2021 19:52:52 GMT

Hello @REJR77

I do this all the time. In the Authentication section select the Certificate Authentication Profile depending on the EAP Method/Tunnel.

The Name of the AD Join Point is set in the Certificate Authentication Profile.

Example below

Re: Find a condition to authenticate to the correct domain with TEAP

REJR77 — Fri, 26 Nov 2021 07:41:01 GMT

Hello @Arne Bier ,

Thank you for the message. This is what I need.

In our case we have Machine Certifcate Authentication AND Username/Password for user (I think I have to use a sequence for that purpose)

If you have 2 different AD domains that run TEAP, can you specify 2 different Cert_Profiles so that it can speed up searches in directories?

Something like:

If Network Access-EAPAuthentication EQUALS TEAP AND DomainA then SEQUENCE_A

If Network Access-EAPAuthentication EQUALS TEAP AND DomainB then SEQUENCE_B

I am not sure the Domain can be a condition at that moment of authentication

Thanks

Re: Find a condition to authenticate to the correct domain with TEAP

Arne Bier — Mon, 29 Nov 2021 11:08:42 GMT

Hello @REJR77

You could put the AD domain into the Certificate Authentication Profile as shown below. Would that work for you?

Re: Find a condition to authenticate to the correct domain with TEAP

REJR77 — Mon, 29 Nov 2021 12:22:41 GMT

Hi @Arne Bier

I've made these 2 rules.

The first one, should match User Authentication sent with MSCHAPv2 in the TEAP Tunnel

The second one, should match the machine certificate sent in EAP-TLS on the TEAP Tunnel

I hope when adding another domain I will be able to duplicate these rules, and therefore asking only the corresponding Active Directory server. (From what I've seen, the order seems to be important (User then Machine)

Re: Find a condition to authenticate to the correct domain with TEAP

Arne Bier — Thu, 09 Dec 2021 02:21:30 GMT

@REJR77 - how did your changes go? Did your config work?