ISE authentication WPA2

[adamgibs7]

Dears

i dont know what i am asking is correct but i am confused,

I want to authenticate users via WPA2 pre-shared key on SSID but these should be only apple users and from windows AD particular group,

Is it possible ??

[Rob Ingram]

Hi,

If you want to allow only users from an AD group then you will need to use WPA2 Enterprise NOT a pre-shared key. If you use a pre-shared key anyone on any device can type use thus without requiring to authenticate to the SSID,

HTH

[adamgibs7]

thanks for the reply,

so you mean to say 802.1X authentication on AD ??? my goal is to separate apple IPAD users from  iphone and android devices, how i can achieve that ,, what conditions i can choose to make IPAD unique, if it is difficult to separate ipad and iphone then no problem atleast i will deny android 

[Rob Ingram]

Yes, if you want to authenticate against AD you'd use 802.1x

[adamgibs7]

thanks again for the quick reply

my goal is to separate apple IPAD users from  iphone and android devices, how i can achieve that ,, what conditions i can choose to make IPAD unique, if it is difficult to separate ipad and iphone then no problem atleast i will deny android

[Rob Ingram]

You can use ISE profiling to determine the OS of the device - therefore determine if it's an apple iphone/ipad or android device. You can then create authorisation rules to permit/deny depending on the type of device

[adamgibs7]

Dear

recently i created a condition of wireless dot1.X and below the  attributes such as

• windows AD particular manager group
• logical profiles contains ipad and iphone

but the problem is if the manager from the particular group gets his personal android he is able to authenticate and he gets the ip address,

when i see the authorization policy it falls proper to which i created then why it is accepting from the android.

[adamgibs7]

Dear Expert,
how i can troubleshoot such problem