Questions regarding Radius + PassiveID

[Nicholas DiNofrio]

Wanted to get more information regarding the use of PassiveID and when it should not be used.

For example, if endpoint supplicant is configured for (Radius) Machine Authentication via EAP-TLS and User-to-IP mapping via PassiveID is desired, is this type of flow supported/compatible?   I ask because we see that the provider is WMI in the Radius Session (Live Session on ISE) but we don't have user information.

We are also looking into leveraging EasyConnect with ISE 2.2 software because it appears we may be able to perform Dot1x for machine identity and then Wired Mab for user identity and PassiveID (user-to-IP mapping) stitched together.

The main issue is that we are working to get PassiveID user information that appears to be successfully obtained from WMI but not found in ISE Live Session or from PassiveID report.

Could you share the best practices when using PassiveID and without EasyConnect if Radius session is expected to overwrite or take priority over the PassiveID user information?

Please let me know if there are any questions or need any additional details.

[howon]

802.1X + Easy Connect use case is not supported. Easy Connect was developed to provide visibility of 'who is behind the endpoint' when 802.1X is not used. Easy Connect enforcement can be enabled by enabling MAB to assign SGT or ACL. If enabling supplicant is not an issue, I suggest looking into enabling it for user auth as well to get user identity information via 802.1x. If combining of machine & user auth is desired then EAP-Chaining should be considered.

[Nicholas DiNofrio]

Is Machine Authentication (Dot1x) & Passive ID via WMI (not EasyConnect) supported?

[howon · Accepted solution]

If your requirement is to get user or merged identity from session where identities exists from both 802.1X machine auth and passive-ID, then no that is not supported yet.

[Nicholas DiNofrio]

Thank you very much, believe that explains why we don't get user identity information when endpoint supplicant configured for Machine Auth (Dot1x).

[Tarik Admani]

Hi,

I have the same requirement, it would be nice to have them merge. Especially for customers looking to take on pxgrid with stable machine auth environments. Is this being tracked or developed for future support. or do we migrate their dot1x config to use both user auth and machine auth?

thanks,