cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

730
Views
0
Helpful
5
Replies
Highlighted
Cisco Employee

Questions regarding Radius + PassiveID

Wanted to get more information regarding the use of PassiveID and when it should not be used.


For example, if endpoint supplicant is configured for (Radius) Machine Authentication via EAP-TLS and User-to-IP mapping via PassiveID is desired, is this type of flow supported/compatible?   I ask because we see that the provider is WMI in the Radius Session (Live Session on ISE) but we don't have user information.


We are also looking into leveraging EasyConnect with ISE 2.2 software because it appears we may be able to perform Dot1x for machine identity and then Wired Mab for user identity and PassiveID (user-to-IP mapping) stitched together.


The main issue is that we are working to get PassiveID user information that appears to be successfully obtained from WMI but not found in ISE Live Session or from PassiveID report.


Could you share the best practices when using PassiveID and without EasyConnect if Radius session is expected to overwrite or take priority over the PassiveID user information?


Please let me know if there are any questions or need any additional details.

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted

If your requirement is to get user or merged identity from session where identities exists from both 802.1X machine auth and passive-ID, then no that is not supported yet.

View solution in original post

5 REPLIES 5
Highlighted
Cisco Employee

802.1X + Easy Connect use case is not supported. Easy Connect was developed to provide visibility of 'who is behind the endpoint' when 802.1X is not used. Easy Connect enforcement can be enabled by enabling MAB to assign SGT or ACL. If enabling supplicant is not an issue, I suggest looking into enabling it for user auth as well to get user identity information via 802.1x. If combining of machine & user auth is desired then EAP-Chaining should be considered.

Highlighted

Is Machine Authentication (Dot1x) & Passive ID via WMI (not EasyConnect) supported?

Highlighted

If your requirement is to get user or merged identity from session where identities exists from both 802.1X machine auth and passive-ID, then no that is not supported yet.

View solution in original post

Highlighted

Thank you very much, believe that explains why we don't get user identity information when endpoint supplicant configured for Machine Auth (Dot1x).

Highlighted

Hi,

 

I have the same requirement, it would be nice to have them merge. Especially for customers looking to take on pxgrid with stable machine auth environments. Is this being tracked or developed for future support. or do we migrate their dot1x config to use both user auth and machine auth?

 

thanks,

Content for Community-Ad