cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1784
Views
10
Helpful
5
Replies

Does ASA5506 support EAP-TLS for IKEv2 remote-access?

train_wreck
Beginner
Beginner

I have an ASA5506 configured as an IKEv2 remote access VPN using certificate authentication, and am trying to work around the horrendously broken IKEv2 client on an iPhone 8. At the moment, it only supports using certificates with EAP-TLS; plain cert auth is broken, and has been for quite some time (Apple seems not to care). So, in order to use the IKEv2 client on the iPhone, your VPN server must support EAP-TLS. I have set up many Linux-based Strongswan servers that support this no problem, but I am having trouble finding out how to do this on an ASA. I am using CLI to configure, not Defense Center.

 

Is this supported? I hope so, as I would really not like to have to set up an entire EAP/RADIUS server just to handle this one stupid device.

1 Accepted Solution

Accepted Solutions

You need external server. FMC don't provide that. You can use NPS to
service this. I know ISE will integrate seamlessly. didn't try NPS

View solution in original post

5 Replies 5

Mohammed al Baqari
VIP Advisor VIP Advisor
VIP Advisor
It is supported but you need NAC (example ISE) authenticate EAP-TLS.

Here is an example with PEAP

https://www.cisco.com/c/en/us/support/docs/security-vpn/webvpn-ssl-vpn/119208-config-asa-00.html

Can FirePOWER Defense Center provide these services? Or can they be provided via an external RADIUS server (Windows NPS, etc?

 

I do not have an ISE, and don't particularly want to invest that much in one.

You need external server. FMC don't provide that. You can use NPS to
service this. I know ISE will integrate seamlessly. didn't try NPS

Thank you!

Please remember to rate useful posts
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers