Authenticate only the Domain Computer

[Saeed Abd Elhalim Hamada]

Dear All, 

i need some help,i need to auth only the domain computer any one not join domain and plug the cable to switch will not auth 

[ahollifield]

Use EAP-TLS and certificates.

https://community.cisco.com/t5/security-documents/how-to-ask-the-community-for-help/ta-p/3704356

[Saeed Abd Elhalim Hamada]

i`m using EAP-TLS for user`s Authentication , but i need to know how can i authenticated only the PC`s join domain  

[ahollifield]

Well if the endpoint has a certificate from your PKI they are probably already on the domain no?  

You can do a binary comparison in the CAP or in the Authorization policies, check that the endpoint is a member of Domain Computers.

[bbouchaiba]

Hi,

If you are using ISE, you can use the attribute below in your authorization profile:

Network Access:WasMachineAuthenticated ==True 

[JPavonM]

But take care with using the attribute Network Access:WasMachineAuthenticated ==True as it may happen that MacOS users won't be authorized as the machine authentication is not passed.

[PSM]

You can create authorization rule where you put a condition to match if the machine is part of "Domain Computers" or similar group in Active Directory. You can refer multiple groups to include all the domain joined endpoints.