802.1x ISE, LDAP, and OSX 10.8.2

[mkriss5681]

We are in the slow process of setting up ISE for 802.1x for all our users. Our Windows guys are working great so far with AD, but or Mac guys use their own LDAP server. I have sucessfully configured the LDAP server into ISE and I am able to authenticate to the LDAP server with switches (PAP) and Linux (EAP-GTC). Currently, I cannot get the OSX computers to use PEAP/EAP to authenticate to their LDAP. They can authenicate to ISE using the internal database. According to the ISE documentation EAP-GTC is pretty much the only option for LDAP that uses some sort of security if you are using usernames and passwords. Unfortuntatly, we do not have direct access to our organizations certificate authority so issueing each computer a trusted cert is a bit of a challenge.

Does anyone have some advice in setting up OSX computers to use ISE against LDAP? I cannot find any documentation of the Apple side that shows EAP-GTC is supported, and we would perfer to stay away from PAP clear text for security reasons.

Thanks.

[Tarik Admani · Accepted solution]

Michael,

Your only option is to use eap-tls because PEAP mschapv2 is a hash based protocol that isnt supported in the ldap protocol. You have to join ISE to AD and can not even use AD as an LDAP DB because mschapv2 will not work.

Hope this link helps:

http://www.cisco.com/en/US/docs/security/ise/1.1.1/user_guide/ise_man_id_stores.html

Thanks,

Tarik Admani
*Please rate helpful posts*

[mkriss5681]

Thanks for the quick answer Tarik. I had a feeling that was going to be the answer.

In order for EAP-TLS to work, does the ISE appliance and the client need to share a same CA? Or is it possible to have multiple certs for the different authentication methods?

The reason I ask is the ISE appliance has a cert used for authethenticating with AD. Our Mac guys might have a different cert from a different CA.

Thanks!

[Tarik Admani · Accepted solution]

Michael,

You can use different CA to authenticate the MAC users, you will have to create a certificate authentication profile. First you need to import the root and all intermediate CAs into the CA store in ISE (and make sure you check trust for client authentication). Configuration notes for this can be found here:

http://www.cisco.com/en/US/docs/security/ise/1.1/user_guide/ise_admin.html#wp1122804

Tarik Admani
*Please rate helpful posts*

[mkriss5681]

Thanks again Tarik! I have a path forward at least. I'll setup an internal CA just for our Apple guys.

[mkriss5681]

I was actually able to force the OSX computers to use EAP-GTC by disabling EAP-MSCHAP on ISE. This is obviously an issue for our AD guys. It seems that OSX is trying MS-CHAP first, then it gives up. There has to be a way to only allow some protocols for certian identity stores. I'll have to keep looking into it.

[Tarik Admani]

Micheal,

Have you tried to set the preferred eap type to GTC and then enable both mschapv2 and gtc, hopefully the windows clients can behave a little better.

Thanks,

Tarik Admani
*Please rate helpful posts*

[mkriss5681]

I did not see that option in ISE or OSX unfortunately. For some reason if OSX sees MSCHAP is available it tried that first.

Sent from Cisco Technical Support iPhone App