User and Machine Authentication

[vivarock12]

Hello

Am having troubles getting my WIFI to work with machine authentication and user authentication i keept trying to reauthenticate every time im not really sure why it doing it at the machine authentication part, but it get that correct.

this is whats happening:
i created a new SSID on a classic WLC to do the test:

this is the SSID configuration:

the AP SW port config

im using the same VLAN for users and management, for the testing.

This is the configturation of the ISE

the thing is the machine auhthentication and users logs like it work but it wont assing the user its IP ADDRESS.

i try the same policy just with the ssid in other ruel and it worked like a charm

any idea what it migth be the problem?

[Rob Ingram]

@vivarock12 are you using EAP Chaining (EAP-FAST or TEAP) or using MAR (no one recommends using MAR anyway)? If not using using EAP Chaining "Network Access WasMachineAuthenticated" will not work.

I would recommend using TEAP over EAP-FAST https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/216510-eap-chaining-with-teap.html

[vivarock12]

Hello Rob,

Thanks for the help as always, but i was trying to doit with MAR using PEAP aparently so ill try with TEAP one question do a need a user CERT for it?

Thanks for the help.

[Rob Ingram]

@vivarock12 

If using WPA2 enterprise then that implies you are using PEAP/MSCHAPv2 or EAP-TLS and in both instances certificates are used. PEAP/MSCHAPv2 validates the server ceritificate (ISE's EAP certificate) and EAP-TLS validates the client and server certificate.

If you want to use TEAP, then you can mix and match PEAP/MSCHAPv2 and EAP-TLS for user and machine authentication, TEAP will just combine the authentications together. So you could use certificate authentication for computer and PEAP/MSCHAPv2 for user, or use certificate for user aswell - you'd obviously have to distribute user certificates.

You do not need to use WPA3, EAP Chaining will work with WPA2 enterprise.

[MHM Cisco World]

You use enterprise wpa2 so there is no check for cert. For this type of l2 authc

Unless I miss something 

For ISE i will check and reply later 

MHM

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213919-configure-802-1x-authentication-on-catal.html

this how you config ISE for wpa2 enterpise 
the username-password internal in ISE is check only there is no need for cert

MHM

[vivarock12]

i was using WPA2 so do you recommend to use wpa3?

[MHM Cisco World]

Hmm 

It is wireless cases

Some wifi client support wpa3 abd other support wpa2' I will check the mix mode (using both in single SSID)

MHM