EAP-FASTV2 with certificates, conundrum

[battyjohn]

To implement EAP-FASTV2 with machine and user auth, our customer has requested we use certificates, separate local machine and individual user. 

How best to distribute the individual user certificate? The network is 802.1x enabled, so I can pull an eap-chaining condition to push a dacl for machine success and user auth fail to restrict access for a gpo update, but it's a bit clunky.

Any suggestions for a better way to do this?

BTW not using certs is not an answer as they are used for always on vpn with anyconnect multi-cert auth. 

[Damien Miller · Accepted solution]

In my opinion, leveraging Microsoft's certificate services in conjunction with group policy auto enrollment is easiest. But the caveat here is that it only works for Microsoft machines. In most environments this is fine, but the larger the business the more frequently I see fringe cases like the proliferation of thousands of Macbooks or Linux desktops. In those environments there is usually some MDM solution managing them which can issue certificates from the same MS CA.

It sounds like they already have some certificates deployed though, you mention that they are using them for always on vpn. How were these certificates issued?

[battyjohn]

Hi, machine certificates get issue with the build, it's user certificates once the pc is ready for deployment that is required, but te environment is fully dot1x so the new policy needs to accommodate user certs distribution. Nam doesn't seem to have an easy way to choose option a then option b and then only option b in future. 

[Mike.Cifelli · Accepted solution]

As Damien mentioned you can use the Microsoft certificate services to take care of management for user certificates for those users using Windows workstations.  I strongly suggest reading this:

https://blogs.technet.microsoft.com/meamcs/2010/12/01/auto-enrollment-avoid-the-challenges-of-making-end-users-manage-their-certificates/

Keep in mind that if you are attempting to use EAP-FASTv2 most vendors do not support this protocol.  There is an industry standard protocol that is referred to as EAP-TEAP.  However, I am not sure if the Windows native supplicant supports EAP-TEAP.  Also, as a heads up if you are planning on moving forward with Cisco's EAP-FAST proprietary protocol you will need to implement AnyConnect with the NAM module in order to support it.  

Depending on your environment it will be less seamless to implement user certificates for those using linux/macs or something other than Windows.  This should help to:

https://community.cisco.com/t5/security-documents/how-to-deploy-eap-chaining-with-anyconnect-nam-and-ise/ta-p/3630969