topic EAP-TLS - Device vs User certificates in Network Access Control

EAP-TLS - Device vs User certificates

monolog99 — Fri, 21 Oct 2022 15:31:42 GMT

Hi,

I have a Cisco ISE server authenticating our Wi-Fi users via EAP-TLS using the Local Computer / Machine certificate on the users PC. The users PC's also have Current User certificates installed as well. I'm trying to use the user cert for authentication in order that I can then perform an AD lookup against the CN of that cert, which is the username. However, ISE is using the device certificate instead, where the CN of that cert is the PC name.

How do you tell ISE to use the User cert instead of the device/machine cert for EAP-TLS ?

Thanks,
Tim.

Re: EAP-TLS - Device vs User certificates

Rob Ingram — Fri, 21 Oct 2022 15:37:16 GMT

@monolog99 you need to configure the supplicant on the windows computer to use "User or computer authentication"

Example: https://integratingit.wordpress.com/2019/07/13/configuring-windows-gpo-for-802-1x-authentication/

Re: EAP-TLS - Device vs User certificates

monolog99 — Mon, 24 Oct 2022 09:26:19 GMT

Many thanks Rob. Cheers.