cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
468
Views
0
Helpful
5
Replies
Beginner

ISE 2.4 - EAP-TLS Not Working - Windows 10 client

I currently have ISE 2.4 setup with 802.1x for wired authentication using PEAP with EAP-MSCHAP v2. This works great. Recently my System Admin team rolled out credential guard, this causes the EAP-MSCHAP to not work. I need to now do EAP-TLS, certificate based.

 

On Windows 10, I changed the authentication method to Microsoft: Smart Card or other certificate. Now when I plug in a laptop or desktop, the NIC instantly says Authentication Failed. Any ideas? 

Everyone's tags (2)
2 ACCEPTED SOLUTIONS

Accepted Solutions
Beginner

Re: ISE 2.4 - EAP-TLS Not Working - Windows 10 client

Thanks everyone for your help. I was missing the machine cert AND the user cert for authentication. Without those on the supplicant, it wont even initiate the process.  I was able to get this going, I have a rule as well in ISE where it attempts the EAP-TLS first, then the PEAP process. All is working fine now.

View solution in original post

5 REPLIES 5
Rising star

Re: ISE 2.4 - EAP-TLS Not Working - Windows 10 client

Are your ISE policies configured to support eap-tls?
Policy->Policy Elements->Results->Authentication->Allowed Protocols (Then assign proper profile to your policy set)
I assume you are using the native supplicant. Do the workstations have a valid certificate for authentication? Is your goal to accomplish both user & computer auth? Can you share supplicant configs as well as ISE policy sets & switchport configs?
VIP Advocate

Re: ISE 2.4 - EAP-TLS Not Working - Windows 10 client

By default, Windows does not enable EAP on the wired interfaces.  You have to enable this under the Windows Services (Wired AutoConfig). Once you have done that, go to the Ethernet adapter and then check the new Security tab that has appeared.  Has the supplicant been provisioned?

Beginner

Re: ISE 2.4 - EAP-TLS Not Working - Windows 10 client

I do have the WIred AutoConfig set, so I do see the Authentication tab. I am using the native windows 10 supplicant. My system admins are quite sure what settings to have set and checked. I see there are 2 places to have the Smart card or certificate selected. What should the windows settings be set to?

Beginner

Re: ISE 2.4 - EAP-TLS Not Working - Windows 10 client

Thanks everyone for your help. I was missing the machine cert AND the user cert for authentication. Without those on the supplicant, it wont even initiate the process.  I was able to get this going, I have a rule as well in ISE where it attempts the EAP-TLS first, then the PEAP process. All is working fine now.

View solution in original post