ISE 2.4 - EAP-TLS Not Working - Windows 10 client

[daniel.born007]

I currently have ISE 2.4 setup with 802.1x for wired authentication using PEAP with EAP-MSCHAP v2. This works great. Recently my System Admin team rolled out credential guard, this causes the EAP-MSCHAP to not work. I need to now do EAP-TLS, certificate based.

On Windows 10, I changed the authentication method to Microsoft: Smart Card or other certificate. Now when I plug in a laptop or desktop, the NIC instantly says Authentication Failed. Any ideas? 

[Mike.Cifelli]

Are your ISE policies configured to support eap-tls?
Policy->Policy Elements->Results->Authentication->Allowed Protocols (Then assign proper profile to your policy set)
I assume you are using the native supplicant. Do the workstations have a valid certificate for authentication? Is your goal to accomplish both user & computer auth? Can you share supplicant configs as well as ISE policy sets & switchport configs?

[Arne Bier]

By default, Windows does not enable EAP on the wired interfaces.  You have to enable this under the Windows Services (Wired AutoConfig). Once you have done that, go to the Ethernet adapter and then check the new Security tab that has appeared.  Has the supplicant been provisioned?

[daniel.born007]

I do have the WIred AutoConfig set, so I do see the Authentication tab. I am using the native windows 10 supplicant. My system admins are quite sure what settings to have set and checked. I see there are 2 places to have the Smart card or certificate selected. What should the windows settings be set to?

[Jason Kunst · Accepted solution]

have you checked some of the other documents? specifically this one?
https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/201044-802-1x-authentication-with-PEAP-ISE-2-1.html

others with google search
https://www.google.com/search?ei=GMZuXeaIAbLF0PEPqLi1iAU&q=ise+wireless+windows+supplicant&oq=ise+wireless+windows+supplicant&gs_l=psy-ab.3...3562.4434..4578...0.3..0.705.968.0j2j6-1......0....1..gws-wiz.......0i71j35i304i39.bq_41sTeZl8&ved=0ahUKEwjm...

[daniel.born007 · Accepted solution]

Thanks everyone for your help. I was missing the machine cert AND the user cert for authentication. Without those on the supplicant, it wont even initiate the process.  I was able to get this going, I have a rule as well in ISE where it attempts the EAP-TLS first, then the PEAP process. All is working fine now.