topic Re: 802.1x with MAC authentication in Wireless

802.1x with MAC authentication

ittechk4u1 — Mon, 05 Jul 2021 15:54:57 GMT

Hello experts,

I want to implement two factor authentication for specific users group. via AD + MAC authentication..

I want to create (Auth annd AuthZ) rule in ISE to allows specific users Group (from AD) and with there mac address.

Could you please guide me to create rules in ISE.

Thanks in advance

Re: 802.1x with MAC authentication

ittechk4u1 — Wed, 01 Aug 2018 04:56:57 GMT

experts...any help about two factor authentication!!!!

Re: 802.1x with MAC authentication

Masato Ueoka — Wed, 01 Aug 2018 05:18:11 GMT

here you are,

https://community.cisco.com/t5/security-documents/two-factor-authentication-on-ise-2fa-on-ise/ta-p/3636120

Re: 802.1x with MAC authentication

Haydn Andrews — Wed, 01 Aug 2018 05:50:20 GMT

I haven't done this myself but there is another thread asking nearly the same thing:

https://community.cisco.com/t5/policy-and-access/dual-authentication-with-mac-and-radius-server/td-p/2542448

About Halfway down is apost by nspasov:

Which looks like it has the answer

Hope this helps

*****Help out other by using the rating system and marking answered questions as "Answered"*****

*** Please rate helpful posts ***

Re: 802.1x with MAC authentication

ittechk4u1 — Fri, 03 Aug 2018 08:20:24 GMT

No its not working!!!!!!

Re: 802.1x with MAC authentication

Sandeep Choudhary — Fri, 03 Aug 2018 08:27:51 GMT

Hi,

Follow these steps:

1. Create a SSID with 802.1x (Dont enable MAC filtering)

2. Create identity group "XYZ" and add the mac address of clients in it.

3. Create a Authentication policy that allows MAB/PEAP and identity store must have AD and Internal host

4. Create AuthZ policy: Match Identity Group and dot1x and return with desired permission.

I hope it will work.

Regards

Dont forget to rate helpful posts

Re: 802.1x with MAC authentication

ittechk4u1 — Fri, 03 Aug 2018 08:39:34 GMT

Ok i will try it and let you know.

Thanks

Re: 802.1x with MAC authentication

ittechk4u1 — Fri, 03 Aug 2018 10:04:24 GMT

Sandeep,

Its not working...

Re: 802.1x with MAC authentication

Sandeep Choudhary — Fri, 03 Aug 2018 10:51:13 GMT

Where exactly its failing ?

is it passing Authentication ? if not then try to create a normal rule:

Authentication Policy:

TWO factor Auth : If (Wirless_802.1x)..........AND.....AllowProtocols: PEAP(or default network access)

Authorization Policy :

TWO factor AuthZ :If (Identity Group name) AND Wireless_802.1x then Permit access(or desired permission)

Regards

Dont forget to rate helpful posts

Re: 802.1x with MAC authentication

ittechk4u1 — Fri, 03 Aug 2018 11:27:23 GMT

Thank you very much. Its working now.

Thanks again.