Radius EAP-TLS user authentication not working

[SecurityEng99]

Hello friends, I configured eap-tls configuration on Cisco ISE using a trusted certificate for both User and Machine for the machine that is in the domain. The machine authentication works fine, but the user authentication didn't work and didn't send anything because I don't see any log on the switch (with a "debug radius authentication) and nothing on ISE Radius logs. I tried to logout and log back in and also tried to restart the machine, but no luck. I'm using physical laptop windows 10 (22H2).  Not sure if this is an issue on the windows or I'm missing something.

FYI, the user authentication is working fine with PEAP (MS-CHAp-V2).

Please let me know if you have any suggestion or advise ?? 

[Marvin Rhoads]

Two things to check:

1. How is the native supplicant configured? (Should be for "User or Computer Authentication" with single sign-on.)

2. Have you checked if Microsoft Credential Guard is configured? https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/configure?tabs=intune#enable-credential-guard

[SecurityEng99]

Hello @Marvin Rhoads  

1- yes, I tried the Machine authentication and it works fine, but when I switch to User authentication it didn't work.

2- I enabled the "Microsoft Credential Guard" as mentioned in the documentation guide, but it is still not working.

I would say this is definitely a supplicant issue, but not sure about the root cause.

[Marvin Rhoads]

Credential Guard will cause the native supplicant to fail. It should be disabled unless you switch to certificate-based authentication.

[SecurityEng99]

I'm using the smartcard or certificate option. In the additional setting, I'm using the User authenticatiion.

[Marvin Rhoads]

If you are not seeing the authentication at all in ISE, then the supplicant must not be sending it.

Double check that your additional setting is using either a. User Authentication or b. User or Computer Authentication. Like this:

[MHM Cisco World]

PEAP ms-chap is work 

Eap-tls not work

That meaning the endpoint trust server cert. But the server not trust endpoint cert.

Check the CA of both cert. It must issuer from different CA 

Then check CA cert. In radius one CA cert. Is missing 

MHM

[SecurityEng99]

EAP-TLS for Machine authentication works (Cert-based)

EAP-TLS for User authentication is not working  (Cert-based)

[MHM Cisco World]

User Cert. check the CA issuer or sub in radius server

MHM