Help with BYOD PEAP and Android certificate requirements

[Mr. Bash]

I'll try to explain our current setup briefly.  Our WLAN environment leverages Cisco WLC's, AP's and Cisco ISE 2.6.  Our BYOD users are local users in our ISE db, when they connect to our BYOD WLAN they merely have to enter in their PEAP [not PEAP-TLS] username and password and that's it, they get routed to the proper interface and out the firewall to the internet.  

I'm pushing to have BYOD devices on-boarded by ISE but that is not going to happen right away.  What we've come up against is that some Android devices actually can't connect anymore because they have a particular security patch that in affect disables PEAP because it doesn't allow you to connect to PEAP and NOT validate the server [ISE] certificate.

Our external PKI provider is Globalsign, one of the temporary work around solutions was to perhaps have our ISE environment receive a signed certificate from a Globalsign intermediate CA that is listed as one of the one's that are already in it's store.  

Essentially we're trying to temporary make sure android/ios devices can "trust" our ISE server because it's trusted by an intermediate CA that is built into the devices themselves.   Is this making sense and feasible?

[Mohammed al Baqari · Accepted solution]

Hi,

Yes, what you said makes sense. You need to use CA signed certificate for
EAP in ISE for the endpoints to trust secure communication with ISE.
Otherwise it will fail.

The ultimate option is to use ISE internal CA capability with BYOD portal
in order to issue a certificate to each endpoint at enrollment which
eliminates the need for CA signed certificate. But as you said this is
quite far.

**** please remember to rate useful posts

[ajc]

Hi Mohammed,

I am facing the same issue and I already thought before reading this post about using the same ISE EAP Cert for both EAP-TLS and PEAP, the problem is that anyone with a public CA Certificate installed on the BYOD device could get access to our EAP-TLS subnet which currently uses our own CA signed certificate which was deployed on company owned devices.

Any documentation that you could suggest on using ISE Internal CA capability to issue certificate. I would like to take a look on that.

thanks

[Mohammed al Baqari]

Hi,

This is very helpful guide covering internal ca in details.

https://community.cisco.com/t5/security-documents/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867#toc-hId--290221034

***** please remember to rate useful posts

[ajc]

Thanks for the information.