assaiging Dynamic VLAN if empoyees or taking personal device

[rameshkumarnakka]

Hi

I configured my ISE on the network

Now if user enter domain account (active directory), he have **ll access on the network

But some user use their personal computer and their domain account to acces the network

How can I add second requirement befor access the network

The second requirement should be to check that computer have been added in the domain

Please can you help me with step by step configuration ?

Regards

[Rob Ingram]

@rameshkumarnakka you will need to distinguish between a AD joined computer and a personal device.

I assume you are currently using PEAP/MSCHAPV2? You could use EAP-TLS for AD joined devices and apply a different set of policies to those devices and another to the personal devices, which could continue to use PEAP/MSCHAPV2.

If you use posture you can perform a registry check to determine if the computer is joined to the AD domain, therefore use posture on your AD joined computers.

Else you could use the AD Probe to lookup to see if the computer is joined to the AD domain, profile the devices and  then use this profiling information in an authorisation rule.

[rameshkumarnakka]

Hey @Rob Ingram 

Thank you for your valuable reply 

Yes. We were using PEAP/MSCHAPV2 ,

but when were using EAP-TLS one error occuring please find below attached SC

 

and we were wondering how to segregate the domain and non domain devices and if it is non-domain we need to assign different VLAN  for that 

[Rob Ingram]

@rameshkumarnakka the client is configured to use certificates, but the ISE policies need reconfiguring to allow EAP-TLS certificate authentication.

EAP chaining for AD joined computers as per @Karsten Iwen comment is another good method.

[rameshkumarnakka]

@Rob Ingram  i want to try the ADprobe for profiling of domain devices in that i was bit struggling to the. condition point can you suggest me based on below Screen schoot

  

[Rob Ingram]

@rameshkumarnakka use "AD-Join-Point"

Here is the guide, refer to the AD Probe section https://community.cisco.com/t5/security-knowledge-base/ise-profiling-design-guide/ta-p/3739456#toc-hId--1046168559

[Karsten Iwen]

The first step is to configure ISE and supplicant for both User and Machine Authentication. When that is working, you can migrate to the EAP method TEAP, where you can do EAP chaining. The ISE checks that user authentication is done from a PC that was previously machine-authenticated.