This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.
I'll try to explain our current setup briefly. Our WLAN environment leverages Cisco WLC's, AP's and Cisco ISE 2.6. Our BYOD users are local users in our ISE db, when they connect to our BYOD WLAN they merely have to enter in their PEAP [not PEAP-TLS] username and password and that's it, they get routed to the proper interface and out the firewall to the internet.
I'm pushing to have BYOD devices on-boarded by ISE but that is not going to happen right away. What we've come up against is that some Android devices actually can't connect anymore because they have a particular security patch that in affect disables PEAP because it doesn't allow you to connect to PEAP and NOT validate the server [ISE] certificate.
Our external PKI provider is Globalsign, one of the temporary work around solutions was to perhaps have our ISE environment receive a signed certificate from a Globalsign intermediate CA that is listed as one of the one's that are already in it's store.
Essentially we're trying to temporary make sure android/ios devices can "trust" our ISE server because it's trusted by an intermediate CA that is built into the devices themselves. Is this making sense and feasible?
Solved! Go to Solution.
I am facing the same issue and I already thought before reading this post about using the same ISE EAP Cert for both EAP-TLS and PEAP, the problem is that anyone with a public CA Certificate installed on the BYOD device could get access to our EAP-TLS subnet which currently uses our own CA signed certificate which was deployed on company owned devices.
Any documentation that you could suggest on using ISE Internal CA capability to issue certificate. I would like to take a look on that.