topic Re: Authenticate only the Domain Computer in Network Access Control

Authenticate only the Domain Computer

Saeed Abd Elhalim Hamada — Mon, 24 Mar 2025 11:04:54 GMT

Dear All,

i need some help,i need to auth only the domain computer any one not join domain and plug the cable to switch will not auth

Re: Authenticate only the Domain Computer

ahollifield — Mon, 24 Mar 2025 11:07:26 GMT

Use EAP-TLS and certificates.

https://community.cisco.com/t5/security-documents/how-to-ask-the-community-for-help/ta-p/3704356

Re: Authenticate only the Domain Computer

Saeed Abd Elhalim Hamada — Mon, 24 Mar 2025 11:13:05 GMT

i`m using EAP-TLS for user`s Authentication , but i need to know how can i authenticated only the PC`s join domain

Re: Authenticate only the Domain Computer

ahollifield — Mon, 24 Mar 2025 11:24:19 GMT

Well if the endpoint has a certificate from your PKI they are probably already on the domain no?

You can do a binary comparison in the CAP or in the Authorization policies, check that the endpoint is a member of Domain Computers.

Re: Authenticate only the Domain Computer

bbouchaiba — Mon, 24 Mar 2025 11:59:53 GMT

Hi,

If you are using ISE, you can use the attribute below in your authorization profile:

Network Access:WasMachineAuthenticated ==True

Re: Authenticate only the Domain Computer

JPavonM — Mon, 07 Apr 2025 07:22:19 GMT

But take care with using the attribute Network Access:WasMachineAuthenticated ==True as it may happen that MacOS users won't be authorized as the machine authentication is not passed.

Re: Authenticate only the Domain Computer

PSM — Mon, 07 Apr 2025 12:43:37 GMT

You can create authorization rule where you put a condition to match if the machine is part of "Domain Computers" or similar group in Active Directory. You can refer multiple groups to include all the domain joined endpoints.