topic EAP-TLS machine authentication with ldaps in Network Access Control

EAP-TLS machine authentication with ldaps

zacakg — Thu, 02 May 2024 11:02:52 GMT

Hello,

We want to use ldaps for communication with AD. Is it possible to use ldaps for machine authentication with EAP-TLS?

Regards,

Re: EAP-TLS machine authentication with ldaps

balaji.bandi — Thu, 02 May 2024 11:46:44 GMT

i do not see any reason its not going to work.

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/216190-configure-and-troubleshoot-ise-with-exte.html

Re: EAP-TLS machine authentication with ldaps

zacakg — Tue, 21 May 2024 11:01:16 GMT

Hello,

The document indicates that machine authentication is not possible with ldap.

Note: LDAP Identity Source on ISE is used only for User authentication.

Regards,

Re: EAP-TLS machine authentication with ldaps

balaji.bandi — Wed, 22 May 2024 06:24:15 GMT

i have re-read your OP

ldaps for communication with AD

can you explain this more to understand better. (as i was in impression you using ISE and Externals source as X)

or you looking to integrade directly with LDAPs?

Re: EAP-TLS machine authentication with ldaps

zacakg — Thu, 23 May 2024 11:28:45 GMT

Hi Balaji,

We are trying to add an ldaps external identity source. And we want to authenticate devices with eap-tls(machine authentication). Is it possible to authenticate clients with eap-tls via ldaps server?

Regards,

Re: EAP-TLS machine authentication with ldaps

balaji.bandi — Thu, 23 May 2024 19:09:45 GMT

Now we go more deep here, what WLC controller and what code running - then check the WLC admin guide is that supported ?

may help if you using WLC 9800 :

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/216744-configuring-catalyst-9800-wlc-with-ldap.html

Re: EAP-TLS machine authentication with ldaps

Rob Ingram — Thu, 23 May 2024 19:38:17 GMT

@zacakg if you are just performing EAP-TLS authentication, that is between the client and ISE.

Lookup to an external identity source is optional. You would need to configure a Certificate Authentication Profile (CAP) and select the Identity Store and choose an option for Match Client Certificate Against Certificate In Identity Store. https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/admin_guide/b_ise_admin_3_1/b_ISE_admin_31_asset_visibility.html?bookSearch=true#ID425

Reference the CAP in the AuthC rules.