With EAP-TLS, can a server and client be signed by different CAs?

[trevorjenix]

With EAP-TLS, can a server and client be signed by different CAs? Say I want my client certs signed by Enterprise CA and my ISE server cert be signed by public CA? Is this supported with NSP EAP-TLS and AnyConnect EAP-FASTv2 with inner EAP-TLS method?

[Venkatesh Attuluri]

both client and ISE need to trust the issuer

[jan.nielsen]

Just to elaborate on what Venkatesh said, yes you can have certs from different ca's on ise and on the client, however ise needs to trust the ca that issued the cert to your client, and your client needs to trust the ca that issued the cert for the iser server. Now regarding NSP i am not sure if that works, AnyConnect with EAP-TLS/EAP-FAST should work fine