ISE deployment with self signed certs

REJR77 — Wed, 16 Oct 2024 20:04:48 GMT

Hello

Usually I use certificate signed by Internal CA, but my customer does not have an PKI and we need to deploy an ISE deployment with self signed.

Do we need to add each ISE admin cert in trusted CA list on the other node ? (PAN Admin certs on secondary Pan and vice versa?)

Thx

Re: ISE deployment with self signed certs

Rob Ingram — Wed, 16 Oct 2024 20:11:03 GMT

@REJR77 the certificates need to be trusted, so yes if using the self signed certificate import the admin certificate to the other node.

If the customer has no PKI environment, use a publically signed certificate for the EAP certificate and PEAP/MSCHAPv2. The clients should already have the public CA certificate in the local computer store, so would trust that certificate. Using PEAP/MSCHAPv2 is no longer recommended though, as this is blocked by Windows credentials guard. The recommendation is to use user/machine certificates for authentication, which you will need a PKI environment.

FYI, ISE does have an internal CA builtin, but that is recommended for BYOD environments.

topic Re: ISE deployment with self signed certs in Network Access Control

ISE deployment with self signed certs

Re: ISE deployment with self signed certs