Dot1x on my wired network using ISE as the authenticator and utilizing

[gabriellimacaitano]

Hello everyone, how are you?

I'm looking to implement Dot1x on my wired network using ISE as the authenticator and utilizing certificates via TLS. I'd like to know if there's a way to generate the certificate directly on ISE and install it on the machines. I've searched through some Cisco documentation sources and couldn't find anything addressing this.

Has anyone done this before? Could you share your opinion on it?

Thanks.

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/214975-configure-eap-tls-authentication-with-is.html

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/215621-tls-ssl-certificates-in-ise.html

Check both link' first for eap-tls and second for ISE self signed 

MHM

[balaji.bandi]

ISE can act as CA and generate  Certificate but i do not believe that ISE can install Certificate on end device ?

you need to find a GPO or kind of SCCM tool to push certificate to all devices.

https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/distribute-certificates-group-policy

[gabriellimacaitano]

Hello Hall of Fame member balaji.bandi, thank you for responding. So, can I use ISE as the certificate authority and then generate the certificate and install it on Windows via GPO? That's what I was hoping for, my friend.

[Marvin Rhoads]

While you CAN use the ISE internal CA to enroll end devices, almost nobody does so. I have never once seen it used thus in working on over 100 customer ISE deployments.

Almost everybody who uses Microsoft AD uses the Certificate Services available on Windows Server - it integrates much better with your domain computers. People who opt not to use AD typically use a third party device management tool (or even Microsoft Intune in the cloud) to enroll computers and issue certificates (among other things).

[balaji.bandi]

yes you can use, But i was in line view @Marvin Rhoads said, if you have AD infrastructure, then why not use Windows PKI Service.