EAP-TLS machine authentication with ldaps

[zacakg]

Hello,

We want to use ldaps for communication with AD. Is it possible to use ldaps for machine authentication with EAP-TLS?

Regards,

[balaji.bandi]

i do not see any reason its not going to work.

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/216190-configure-and-troubleshoot-ise-with-exte.html

[zacakg]

Hello,

The document indicates that machine authentication is not possible with ldap.

Note: LDAP Identity Source on ISE is used only for User authentication.

Regards,

[balaji.bandi]

i have re-read your OP 

 ldaps for communication with AD

can you explain this more to understand better. (as i was in impression you using ISE and Externals source as X)

or you looking to integrade directly with LDAPs?

[zacakg]

Hi Balaji,

We are trying to add an ldaps external identity source. And we want to authenticate devices with eap-tls(machine authentication). Is it possible to authenticate clients with eap-tls via ldaps server?

Regards,

[balaji.bandi]

Now we go more deep here, what WLC controller and what code running - then check the WLC admin guide is that supported ?

may help if you using WLC 9800 :

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/216744-configuring-catalyst-9800-wlc-with-ldap.html

[Rob Ingram]

@zacakg if you are just performing EAP-TLS authentication, that is between the client and ISE.

Lookup to an external identity source is optional. You would need to configure a Certificate Authentication Profile (CAP) and select the Identity Store and choose an option for Match Client Certificate Against Certificate In Identity Store.   https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/admin_guide/b_ise_admin_3_1/b_ISE_admin_31_asset_visibility.html?bookSearch=true#ID425

Reference the CAP in the AuthC rules.