My POC has worked but when I did some pilot sites on the on prem ISE I am having two issues.
1. When I uploaded and binded the server certificate (from onpre PKI) for eap authentication. the existing eap authentication got moved here. The Win11 machines worked on the existing corp ssid but win10 didn't. I got an error saying ise is not trusting client certificate being presented. I disabled my new nac ssid policy yet the corp ssid won't work for win10 but works for win11. The Win11 are on Intune and Win10 is by AD. But I see server certificate on both win10 and win 11 in trusted and intermediate store on both the machines. Not sure how can I seamslessly implement it without causing an outage.
2. I am thinking I will rollout the machine certs to no just pilots but all win10 in the estate but this way it poses risk of multiple incidents. But I believe regardless if its win10 or win11 if its issued with a new machine cert from PKI/cert connector the machines will continue to connect on the existing corp ssid regardless if it works on new nac enalbed ssid or not.
3. a quick question on the ISE policy - I am placing the new nac ssid at the top in the policy table using nas id in the wlc and also in ise policy along with radius wireless 802.1x to make sure existing corp ssid traffic doesn't hit this policy and isn't affected is this right approach?
