Cisco ISE 2.4 Endpoint running VM

[Axsalon]

Hi,

How would you manage corporate laptops (authenticated with EAP-Fast) with Virtual Machines running inside? How would you authenticate this virtual machines?

Thanks in advance.

[Arne Bier]

Interesting question.  Are the VM's network interfaces bridged to the host machine to even allow EAP to function?  

Why would you want to do EAP from a VM if the host is already authenticated?  I would think that if the VM is domain joined then the domain authentication to AD is what you're really interested in.  

[Axsalon]

My question is more related in VMWare-Devices for example, I know that the ISE can identify virtual devices running in the network, but it should be necessary install 802.1X supplicants in these virtual endpoints?

If the VM is not compliant, can the ISE deny the access to the physical endpoint where the VM is running?

[Arne Bier · Accepted solution]

What is an example of a “VM device” ? Do you mean a Client endpoint like a Windows 10 running in a VM? Then of course this is like any other Windows device. Question is HOW is that client’s network adapter connecting to the network? Via a virtual switch that can act as an Authenticator (eg Nexus1000v) or to a real switch? 

A Radius Server like ISE (or any other) only gets involved if there is an Authenticator that specifically makes the request via some security policy, be it 802.1x or MAB. Just plugging a device into a switch port that is not NAC controller is not a AAA event.