topic We most typically do this in in Network Access Control

How to authenticate with certificate?

miaozhixu — Mon, 11 Mar 2019 04:50:24 GMT

I wanna try to build a more secure LAN. I want every client (wired/wireless) to connect the network used a certificate not a user/password pair.

But now, as i am a newbie, I don't know what to choose between TACACS+ and RADIUS. Because I have a Mac mini, maybe RADIUS is more suitable, but i don't know how to establish the CA.

Any help or suggestion will be appreciated!

Refer " Certificate

Saurav Lodh — Tue, 01 Jul 2014 03:16:29 GMT

Refer " Certificate Authentication Profiles" from

http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_man_id_stores.html#18226

We most typically do this in

Marvin Rhoads — Tue, 01 Jul 2014 03:29:25 GMT

We most typically do this in the context of implementing a product like Cisco's Identity Services Engine (ISE). ISE uses 802.1x and has the ability to check clients for things like a certificate during the authentication / posture assessment / remediation process.

It also acts as a RADIUS server and can dynamically push out Change of Authorization (CoA) to the authenticator (i.e switch or Wireless controller) in order to control things like client VLAN assignment and any access-lists you may want to apply.

On the client side, a supplicant is used to interact with the authenticator. You can use native supplicants from OS X or Windows etc. but we generally recommend use of Cisco's AnyConnect Secure Mobility client with its Network Access Module (NAM) as it's much more full-featured for that purpose.

You could also do 802.1x with certificate authentication and use a different backend authentication server (like a regular Cisco ACS or Microsoft Network Policy Server) but you would just get more basic authentication vs. the rich functionality ISE gives (albeit ISE costs a lot more 😉 ).

Have a look at this Youtube video for an example of setting up certificate authentication on ACS:

https://www.youtube.com/watch?v=U7qWJ7bIMHA

Marvin Thanks a lot. You

miaozhixu — Tue, 01 Jul 2014 05:17:29 GMT

Marvin

Thanks a lot. You gave me a very detail answer! As I have checked the price of ISE, I will make a decision on building a TACACS+ Server from source on my poor Mac mini.

"Certificate Authencation

miaozhixu — Tue, 01 Jul 2014 11:19:31 GMT

"Certificate Authencation Profiles" just include detail on how to setup in MS Windows AD, but the "RADIUS Token identity sources" did help me a lot.

Thanks very much!