We’re using TEAP with EAP-TLS and EAP-Chaining in our ISE deployment for wired network access. The configuration follows this Cisco document:
https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/216510-eap-chaining-with-teap.html
Our authorization policy is similar to the pic below.
The problem was that some users got network access without a valid user certificate. After checking, I found that machine certificate was present, but the valid user certificate was missing. Yet, the user still gained network access. Since TEAP failed user authentication but succeeded in machine authentication, ISE allowed access through the machine-only rule.
Before, we were using TEAP with MSCHAPv2, and with that setup, this issue never happen because of how the authentication process works.
I can tweak the machine-only authorization profile to limit access, but I’d like to know if anyone else has faced this and any suggestions on how to handle it?
