ISE 1.2 - Authorization Policy for Digital Certificates

[Tiago Andrade de Paula]

Hi Everyone.

I have Cisco Ise 1.2 when I created authorization Policy rule for PEAP(MSCHAPv2) and the ISE can match on the rule e permit based on AuthProfile.

BUT, authentications using digital certificates (EAP_TLS) I can´t do some AuthorizationPolicy for match.

I´m try some:

if

any

AND

authEAPprot: EAP-TLS

AND

Certificate:inssue : iqual : CA-root

THEN

ACCESS_FULL

In Operations>Authetications I can see the authentication and when I open the details, I can see the method is EAP-TLS BUT my rule is not correct cuz authorization policy that use is Default.

Someone can do some Tip about How i can make this rule for authentications that use EAP-TLS (digital certificates)???

tks

[jan.nielsen]

Well, it just sounds like it's not matching your rule, try removing the certificate issuer = CA-root condition and see what happens.

Remember that if you use equals as operator, it has to match exactly including case, what your certfificate have written in the certificate issuer field you are using.

[Tarik Admani]

Hi,

You will have to upload all certificates (intermediate and root) that are used to sign the client cert into the ISE CA database. You will also have to make sure that checkbox for trust for client authentication is checked.

Thanks,

Tarik Admani
*Please rate helpful posts*