topic User and Machine Auth cisco ISE in Network Security

User and Machine Auth cisco ISE

Tutu — Mon, 09 Nov 2020 12:12:28 GMT

Hello can i please know which is the best method for user and machine authentication ?

Thank you in a advance.

Re: User and Machine Auth cisco ISE

balaji.bandi — Mon, 09 Nov 2020 12:20:18 GMT

PKI and AD Integration.

Re: User and Machine Auth cisco ISE

Tutu — Mon, 09 Nov 2020 12:36:34 GMT

Can u please give me a guide ? for configuration for wired please

Re: User and Machine Auth cisco ISE

Mike.Cifelli — Mon, 09 Nov 2020 14:31:27 GMT

You have a lot to consider here. A few things you should be aware of/consider:

-In order to accomplish BOTH user and machine authentication you will need to rely on eap-chaining. Typically this is/was accomplished via Cisco's EAP-FAST with AnyConnect NAM being used as your supplicant on clients. The industry standard is EAP-TEAP which supports eap-chaining and the ability to rely on the Windows built-in native supp. The caveat here is for TEAP support you need to be running at least ISE 2.7 and Win10 build (from May 2020 I believe). If you decided to rely on AnyConnect NAM just keep in mind that now you will need to manage additional software on clients which includes keeping up with upgrades, user education, etc. As @balaji.bandi mentioned your best (most secure) option is to rely on user/comp certs for auth. See the following for additional info:

https://www.ise-support.com/2020/05/29/using-teap-for-eap-chaining/

https://community.cisco.com/t5/security-documents/ise-secure-wired-access-prescriptive-deployment-guide/ta-p/3641515

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/eap-fast/200322-Understanding-EAP-FAST-and-Chaining-imp.html

HTH!

Re: User and Machine Auth cisco ISE

balaji.bandi — Mon, 09 Nov 2020 17:09:39 GMT

here is the good resources :

https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/ise_active_directory_integration/b_ISE_AD_integration_2x.html

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/214975-configure-eap-tls-authentication-with-is.html

https://www.lookingpoint.com/blog/cisco-ise-basic-802.1x-policy-set