Machine authentication using certificates + AD user/pass

[balmain99]

For an environment with ISE 2.2 and external MS CA, can I use:

Machine certificates for authentication combined with AD user/pass for authorization ?

[Rob Ingram]

Hi,

If you use AnyConnect as the client supplicant, then yes you can use certificates for machine auth and username/password (PEAP/MSCHAPv2) for user auth. With Windows native supplicant you have to use either machine and user certificates or machine and user PEAP/MSCHAPv2.

HTH

[balmain99]

Hello, thanks for your message.

So if we leave the Anyconnect option out, there are two options If I decide to use machine certificate:

1) Machine + User certificate

2) Machine + PEAP/MSCHAP2

I actually thought option 1) required Anyconnect (or TEAP).

Kindly confirm option 1).

[Rob Ingram]

I think you are referring to EAP-Chaining aka TEAP (AnyConnect only) this is when machine AND user authenticates are combined. So you can validate an authenticated user is permitted access from a device that was machine authenticated.

Windows native supplicant can individually authenticate a machine and user but these authentications are independant and cannot be easily combined...unless you use MAR, but that has it's downsides and can cause problems if a laptop moves between wired and wireless.

[balmain99]

Thanks a lot RJI.

So if I have a customer who:

- does not want Anyconnect or TEAP

- must use machine certificate

Can he just use machine certificate for wireless access ? Not so good an idea ?

Or what does he combine it with ?

Thanks again.

[Rob Ingram · Accepted solution]

You can just use machine certificates, you just need to configure a Windows group policy to user machine only authentication. You could combine it with a user certificate (you would need to specify machine and user authentication in the group policy instead of machine authentication). Using user certificates does make deployment of certificates more complex, so using just machine certificates may makes things simplier