Can TLS version be a condition in an authentication or authorization policy?

[Nadav]

Hi everyone,

I was wondering if I can create policy sets where the TLS version (and possibly even cipher suite) can be a stipulation for success. For example, if a certain group of endpoints support TLS 1.0, 1.1 and 1.2, I could demand that only if they negotiated on TLS 1.2 would authentication succeed.

Thanks!

[Jason Kunst · Accepted solution]

It seems like this is a duplicate of another question posted recently. Perhaps on another forum or same from another team member?

Pretty sure the answer is no on this. I will Double check

It’s a global setting so if a client can do 1.2 then it does. If another client can’t it will negotiate lower if ise is set to allow it

[Francesco Molino · Accepted solution]

Hi

You will need to enable the TLS version you authorize to communicate (authenticate) with ISE. By default (on version 2.x) it's TLS1.2.

However, you won't be able to do some policies based on TLS version. You can just play with global settings by allowing tls1.0 and tls 1.1 or not.

[Nadav]

Hey,

Globally enabling or disabling a TLS version isn't the most granular of approaches, but it's what the product supports.

I sent an enhancement request a few days ago to support authenticating by TLS version as part of an authentication policy, so that certain endpoints can authenticate only with TLS 1.2, others only with TLS 1.1 or TLS 1.0, etc.

This is in part to avoid renegotiation attacks and using susceptible encryption and hash functions. 

I hope someone in Cisco will think it over :)

[Jason Kunst · Accepted solution]

Confirmed please reach out to the ise product management team for an enhancement