Authtication policy can't use EAP-TLS

[hamzazidane]

Hello,

We have a problem in the configuration of the Authentification Policy, im selecting EAP-TLS in order to force clients to use the certification that i exported from the ISE, but the endpoint can only authenticate using "PEAP (EAP-MSCHAPv2)" even if there is no rule for this protocol.

Thanks to help us.

[Jason Kunst · Accepted solution]

have you tried using the default authentication ruleset and simple relying on authorization rules?

Simple examples here in the BYOD guide (you don’t need the BYOD rules) just the one with cert auth minus registration state

See page 25 remove the BYOD is registered and that should work
https://community.cisco.com/t5/security-documents/cisco-ise-byod-deployment-guide/ta-p/3641867

[paul · Accepted solution]

in EAP-TLS each client should have their own certificate.  You shouldn't be trying to export a certificate from ISE and trying to get the client's to use it to authenticate EAP-TLS.  Further more if you are trying something like this you need to export both the cert/private key and ensure the certificate has EKU client auth enabled.