Can your IOT devices do 802.1x? Especially EAP-TLS? If not, then I am curious to know why you would want to generate certificates from ISE. If they do support, why not get certificates from your Enterprise CA ? (unless you do not have one)
If they support EAP-TLS and you would want to authenticate them with ISE :
You can use ISE to generate certificates for IOT devices. it will require manual intervention to generate certificates on ISE and install them on the IOT devices. There is no automatic way you can get this done.
Once you have the certificates installed, there shouldn’t be any problem authenticating those devices if both the device and ISE are configured properly.
There is no best practices or a guide to do this because most IoT devices are usually low cost, limited resource devices which have a defined function. They usually do not support advanced features like EAP-TLS or any standard authentication mechanism providing a supplicant that ISE can leverage for authentication. They may not have enough resources on them to provide such funcationality.
