topic Re: Machine and User Auth wireless? in Network Access Control

Machine and User Auth wireless?

bhartsfield — Wed, 22 Dec 2021 03:51:19 GMT

I have a request on an ISE 3.0 setup to use AD authentication on wireless 802.1x (5520 WLC) to specicify specific ACLs but also only allow access from corporate machines so a user can't pull up their ipad and enter in their AD credentials.

From my research it seems this is only possible if use the anyconnect NAM which we would prefer not to do.

So are there any options to do Cert machine Auth AND then user AD auth to for ACL application using ISE 3.0?

Re: Machine and User Auth wireless?

Rob Ingram — Wed, 22 Dec 2021 10:49:06 GMT

@bhartsfield

You can do combine machine and user authentication using the relatively new TEAP protocol, assuming your computers are using Window 10 build 2004.

Reference:- https://community.cisco.com/t5/security-documents/teap-for-windows-10-using-group-policy-and-ise-teap/ta-p/4134289

Re: Machine and User Auth wireless?

Arne Bier — Wed, 22 Dec 2021 21:01:11 GMT

Hello @bhartsfield

If EAP-TEAP or NAM is not an option then perhaps there is another way:

1) If the corporate machines are domain joined, then you could use Group Policy to push a machine cert to the AD joined devices, and push a profile that connects to the corp SSID using that cert. On the ISE Wireless 802.1X Policy Set, create a new "Allowed Protocols" where only EAP-TLS is ticked. That will ensure that corp devices MUST use certificates to connect - clients who don't have certs won't have a chance on the corp SSID.

2) Allow EAP-PEAP, but check whether the user is a member of Domain Computers in the Authorization. Only domain joined computers will be members. Regular users will fail that check on the corp SSID.

3) Create a separate SSID for employees to connect to, using their AD creds. Apply the VLAN/ACL as required.