cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

1117
Views
15
Helpful
4
Replies
rfountain
Beginner

Help with BYOD PEAP and Android certificate requirements

I'll try to explain our current setup briefly.  Our WLAN environment leverages Cisco WLC's, AP's and Cisco ISE 2.6.  Our BYOD users are local users in our ISE db, when they connect to our BYOD WLAN they merely have to enter in their PEAP [not PEAP-TLS] username and password and that's it, they get routed to the proper interface and out the firewall to the internet.  

 

I'm pushing to have BYOD devices on-boarded by ISE but that is not going to happen right away.  What we've come up against is that some Android devices actually can't connect anymore because they have a particular security patch that in affect disables PEAP because it doesn't allow you to connect to PEAP and NOT validate the server [ISE] certificate.

 

Our external PKI provider is Globalsign, one of the temporary work around solutions was to perhaps have our ISE environment receive a signed certificate from a Globalsign intermediate CA that is listed as one of the one's that are already in it's store.  

 

Essentially we're trying to temporary make sure android/ios devices can "trust" our ISE server because it's trusted by an intermediate CA that is built into the devices themselves.   Is this making sense and feasible?

1 ACCEPTED SOLUTION

Accepted Solutions
Mohammed al Baqari
VIP Advisor

Hi,

Yes, what you said makes sense. You need to use CA signed certificate for
EAP in ISE for the endpoints to trust secure communication with ISE.
Otherwise it will fail.

The ultimate option is to use ISE internal CA capability with BYOD portal
in order to issue a certificate to each endpoint at enrollment which
eliminates the need for CA signed certificate. But as you said this is
quite far.

**** please remember to rate useful posts


View solution in original post

4 REPLIES 4
Mohammed al Baqari
VIP Advisor

Hi,

Yes, what you said makes sense. You need to use CA signed certificate for
EAP in ISE for the endpoints to trust secure communication with ISE.
Otherwise it will fail.

The ultimate option is to use ISE internal CA capability with BYOD portal
in order to issue a certificate to each endpoint at enrollment which
eliminates the need for CA signed certificate. But as you said this is
quite far.

**** please remember to rate useful posts


View solution in original post

Hi Mohammed,

 

I am facing the same issue and I already thought before reading this post about using the same ISE EAP Cert for both EAP-TLS and PEAP, the problem is that anyone with a public CA Certificate installed on the BYOD device could get access to our EAP-TLS subnet which currently uses our own CA signed certificate which was deployed on company owned devices.

 

Any documentation that you could suggest on using ISE Internal CA capability to issue certificate. I would like to take a look on that.

 

thanks

Hi,

This is very helpful guide covering internal ca in details.

https://community.cisco.com/t5/security-documents/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867#toc-hId--290221034

***** please remember to rate useful posts

Thanks for the information.

Content for Community-Ad