ISE EAP-TLS Authentication over the internet

[GFernandez07]

Hi experts, 

I’m looking for advice on a scenario involving multiple retail stores. I want to implement EAP-TLS authentication for employee WiFi connections through Cisco ISE. Since these stores don’t have a VPN tunnel, I’m considering setting up an ISE PSN in the DMZ. This would allow the stores to communicate directly over the internet with the ISE node, which is part of our existing distributed deployment.

Are there any security concerns I should be aware of? Is this approach advisable?

Has anyone had experience with this type of setup? I’d appreciate any insights.

Thanks!

[Arne Bier · Accepted solution]

I have not done it but it would entail setting up RADIUS DTLS connections between the wireless controller (or APs?) towards the ISE PSN node. That's as secure as any TLS style of communication can be over the internet.

Depending on the NAD, and if you have ISE 3.3+, you can also use IPsec to secure the RADIUS comms.. 

And then I guess block all non RADIUS comms (admin access (http and ssh)) from the internet to that PSN.

[Flavio Miranda]

@GFernandez07 

The Challenge I see on this scenario is the certificate provisioning. If you dont manage the end user device, It could be a problem provision and keep the certificate up to date. You need some kind of MDM which means,  you need to manage all devices 

[Arne Bier]

End client certificate provisioning is problem regardless of how the NAD talks to the RADIUS server.  I thought the focus of the question was more about the RADIUS comms between WLC and PSN. But Flavio, you are right, that's usually a bit of a hurdle for anyone, and the only easy solution is Group Policy for on-prem AD - if they don't have on-prem AD, then MDM would be next best thing.  @GFernandez07  How do you plan to provision your employee devices?  

[GFernandez07]

@Arne Bier , @Flavio,

Thank you both for the input. The plan is to manage the client devices using an MDM and to push the certs.

I will give this a try and see how it goes. That is if the security team allows it.