topic EAP-TLS Fall back in Network Access Control

EAP-TLS Fall back

henokk60 — Mon, 01 Sep 2025 07:25:54 GMT

Hi All,

We plan to migrate ISE Authentication from PEAP to EAP‑TLS and want the transition to be as smooth as possible. I would like to know if it is feasible to configure EAP‑TLS as the primary authentication method with PEAP as a fallback, and if so, how this can be implemented?

Thanks

Re: EAP-TLS Fall back

shana598brush — Mon, 01 Sep 2025 07:58:50 GMT

@henokk60 wrote:
Hi All,
We plan to migrate ISE Authentication from PEAP to EAP‑TLS and want the transition to be as smooth as possible. I would like to know if it is feasible to configure EAP‑TLS as the primary authentication method with PEAP as a fallback, and if so, how this can be implemented?
Thanks

Yes, it's feasible using multiple authentication policies in Cisco ISE. You can configure EAP-TLS as the primary method and set a secondary policy for PEAP fallback. Ensure your Allowed Protocols list includes both methods, and use identity source sequences to prioritize certificate-based auth while allowing AD fallback for PEAP.

Best Regards,
Shana Brush

Re: EAP-TLS Fall back

MHM Cisco World — Mon, 01 Sep 2025 11:45:36 GMT

Can I see ISE policy of PEAP?

MHM

Re: EAP-TLS Fall back

Rob Ingram — Mon, 01 Sep 2025 15:22:41 GMT

@henokk60 the native windows supplicant doesn't support fallover, Cisco NAM should if you have multiple profiles and define an order. If your supplicant doesn't support fallover then you'd have to rely on MAB for fallback.

Cisco ISE will authenticate using any protocol offered by the client as long as it's defined in the allowed protocols list.

In an ISE deployment typically you deploy Monitor Mode first, which still permits network access if authentication fails. During this phase you monitor the authentication lgos and rectify any authentication issues for devices failing to authenticate, only then do you proceed to low-impact or closed mode.

Re: EAP-TLS Fall back

MHM Cisco World — Tue, 02 Sep 2025 15:45:00 GMT

PEAP have two inner authc

One is MSCHAPv3 and other is EAP-TLS

You can only enable eap-tls under peap in allow protocol and do some change in authc policy

This make both user (peap mschapv3 and peap eap-tls) to authc

MHM