cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

919
Views
5
Helpful
2
Replies
nathgregory
Beginner

Windows 10 TEAP EAP-Chaining with ISE

We are just starting to test using TEAP with Windows and Cisco ISE (EAP-Chaining) rather than use the AnyConnect NAM module.

 

We have deployed Workstation Authentication Certificates and are trying to get the machine authentication done via certificate and the user authentication via username/password (MSCHAPV2) - both of which will be Active Directory authenticated.

My main question is that so far the ISE Live Logs show EAP (MSCHAPV2) for both the machine and user auth.

Is using MSCHAPV2 secure enough for machine authentication?

Is it actually the certificate or not?

Or should I be aiming to ensure the machine authentication part is EAP-TLS?

Bit confused about how secure machine auth is with MSCHAPV2.

We have experimented with the settings on Windows but cannot seem to get the cert for machine auth to work?

1 ACCEPTED SOLUTION

Accepted Solutions
Greg Gibbs
Cisco Employee

Certificate-based EAP methods like EAP-TLS are generally considered more secure than password-based methods like PEAP-MSCHAPv2. See this blog for details on two.

Machine auth using EAP-TLS is common, but lots of organisations find user certificate-based user auth too difficult to manage due to certificate enrollment, expiry, etc. TEAP supports using EAP-TLS for machine auth and PEAP-MSCHAPv2, so it's a viable option to mitigate user certificate concerns. It also provides the added benefit of EAP Chaining. I would suggest reviewing the Using TEAP for EAP Chaining document and comparing it to your setup.

It's not very clear in the UI but, in the Client Authentication section of the supplicant the 'Primary EAP method' refers to the User auth state, and the 'Secondary EAP method' refers to the computer auth state.

View solution in original post

2 REPLIES 2
Greg Gibbs
Cisco Employee

Certificate-based EAP methods like EAP-TLS are generally considered more secure than password-based methods like PEAP-MSCHAPv2. See this blog for details on two.

Machine auth using EAP-TLS is common, but lots of organisations find user certificate-based user auth too difficult to manage due to certificate enrollment, expiry, etc. TEAP supports using EAP-TLS for machine auth and PEAP-MSCHAPv2, so it's a viable option to mitigate user certificate concerns. It also provides the added benefit of EAP Chaining. I would suggest reviewing the Using TEAP for EAP Chaining document and comparing it to your setup.

It's not very clear in the UI but, in the Client Authentication section of the supplicant the 'Primary EAP method' refers to the User auth state, and the 'Secondary EAP method' refers to the computer auth state.

View solution in original post

Thanks that got it working!

Create
Recognize Your Peers
Content for Community-Ad

ISE Webinars



Did you miss a previous ISE webinar?

CiscoISE YouTube Channel