ISE - EAP TLS Multiple Users login Auth Issue

[AMA ALS]

I implemented Cisco ISE using EAP-TLS for user authentication. Authentication works fine for the machine owner only. However, when other users log in to different machines, authentication fails because their certificates are not installed on those machines.

We tested a scenario where user authentication fails and machine authentication passes, which initially provides limited access. However, once the machine is successfully authenticated and the user starts to log in, access is lost and the user is unable to connect to the network.

 How to solve this issue? 

@ISE 

[Karsten Iwen]

I see three ways to solve this:

1. Only do Machine-Authentication and treat every user identically.
2. Authenticate the machine with certificates, but use username/password for the user (a more legacy approach).
3. Make sure that the certificate moves with the user => Smartcards.

[Cristian Matei]

Hi,

   If, most probably, you want to keep user authentication as well, you need to use an AD GPO that automatically installs user certificate upon user login, which will allow successful EAP-TLS authentication for the user as well (ensure that machine authorization allows connectivity with AD for this process to work); find more information as well as a complete guide here:

https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/distribute-certificates-to-client-computers-by-using-group-policy

https://lostintransit.se/2024/11/07/leveraging-gpo-to-distribute-user-and-computer-certificate/

    The other option to keep the same solution you're looking for, would be to have the user certificate installed on a smart card / USB dongle and have the user attach it to the computer before login.

   Otherwise, use only machine authentication(however you'll not be able to perform different authorizations per user), or change PEAP (EAP-TLS) with PEAP(EAP-MSCHAPv2).

Thanks,

Cristian.

[AMA ALS]

Hi @Cristian Matei

Thank you for your support. 

Machine authorization currently set to permit access, is the user certificate will installed during the machine authentication/ Authorization process?

[Greg Gibbs]

No. The user cert is enrolled by the user GPO, which happens after the user authentication process resulting in a catch-22 scenario.

The best way to mitigate this issue is using TEAP with EAP Chaining as discussed in this post:
https://community.cisco.com/t5/network-access-control/eap-teap-first-time-user-login-chicken-amp-egg-scenario/td-p/4475351