topic Re: Testing EAP-FAST (Eap-MSCHAPv2, Eap-TLS) in Network Access Control

Testing EAP-FAST (Eap-MSCHAPv2, Eap-TLS)

Da ICS16 — Fri, 26 Jul 2024 08:41:06 GMT

Dear Community,

Current we plan testing EAP-FAST (Eap-MSCHAPv2, Eap-TLS) authentication.

By Machined join domain and get certificate to be trusted device. What if the another new machine imported certificate (export cert from PC trusted machined) , does it work or not for the new machine connection to ISE? thanks.

Thanks,

Re: Testing EAP-FAST (Eap-MSCHAPv2, Eap-TLS)

ccieexpert — Sat, 27 Jul 2024 04:02:36 GMT

Hi if you mark the certificate as non exportable it will provide protection, but if its not TPM protected, then a malware may be able to export it.

The best protection is to use TPM and not all machine have TPM (older ones), but alteast blocking private key export in your cert template is a good fall back..

https://polansky.co/blog/tpm-backed-certificates-windows/

**Please click on Helpful button if this was useful**

Re: Testing EAP-FAST (Eap-MSCHAPv2, Eap-TLS)

Da ICS16 — Mon, 29 Jul 2024 01:56:20 GMT

Dear @ccieexpert ,

If we do not put passkey on certificate and some one will perform this case, does it work?

Thanks,

Re: Testing EAP-FAST (Eap-MSCHAPv2, Eap-TLS)

ccieexpert — Mon, 29 Jul 2024 02:15:02 GMT

i am not understanding your question ?

some certificates you can put a password etc.. but the password is not very helpful as it can be cracked ... what i am saying if you make it non exportable is good.. The best option is to use non exportable with TPM for best security ..

**Please click on Helpful button if this was useful**

you

Re: Testing EAP-FAST (Eap-MSCHAPv2, Eap-TLS)

Da ICS16 — Mon, 29 Jul 2024 02:28:25 GMT

OK understand. thanks.

Re: Testing EAP-FAST (Eap-MSCHAPv2, Eap-TLS)

ccieexpert — Mon, 29 Jul 2024 02:36:04 GMT

Your welcome:)

**Please dont forget to rate as helpful and also accept as solution if this was indeed helpful**