topic Re: user auth without user cert? in Wireless

user auth without user cert?

jmcgrady1 — Wed, 24 Apr 2024 05:22:23 GMT

We have a chicken & egg situation where ISE requires a user's login and the presence of a user cert from AD before the user can be permitted to connect to the corporate wifi. But the user needs to connect to wifi to get the cert.

One solution i have read is to have a 2 phase login. A user with just an AD machine member cert will fail the standard login. ISE can then drop through to a secondary auth which requires user/pass & machine cert. When this is successful, user is dropped into a staging vlan on their switch+AP. The staging vlan only allows connection to what is needed to load the required cert. Group policy and login scripts will recognise the presence of the staging vlan, load the client with the needed cert, and then reboot the client.

I'm using ISE v3.2 and a 9800 vWLC. Assuming flexconnect mode for APs with local switching at the AP end, i cant see how to get an AP+SSID to drop a single client into different vlans depending on auth results. Is there a guide available for this kind of thing?

Re: user auth without user cert?

Mark Elsen — Wed, 24 Apr 2024 05:31:12 GMT

>....load the client with the needed cert, and then reboot the client.
- Hmm, normally in 'standard company environments' the needed machine cert(s) are part of the standard installation , done by company IT dept when providing a windows PC to the end user (e.g.)

Re: user auth without user cert?

jmcgrady1 — Wed, 24 Apr 2024 06:16:28 GMT

Indeed the machine cert is available. However the customer is requiring that an individual user cert be present before a client can be permitted to connect to the corporate wifi proper.

Re: user auth without user cert?

Mark Elsen — Wed, 24 Apr 2024 06:43:47 GMT

- A big part of it is also an ISE procedure , I would therefore advise to post the question also in :
https://community.cisco.com/t5/network-access-control/bd-p/discussions-network-access-control

Re: user auth without user cert?

Rich R — Wed, 24 Apr 2024 13:38:49 GMT

> i cant see how to get an AP+SSID to drop a single client into different vlans depending on auth results

Use VLAN Override: https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/217043-configure-dynamic-vlan-assignment-with-c.html