permit only one identity on ISE 1.3

[ITZEL POSADA RAMIREZ]

I have ISE 1.3 with one authentication and authorization policy with EAP-TLS. Works correctly, but i saw in the authentications report,  an identity with two different mac address and were allowed by policys.

I need permit only an identity with one device. Because the user copied his certificate on other device and got access the network.

Is possilble make this?

[jan.nielsen · Accepted solution]

ISE does not support restricting an identity to only be used with one device in this scenario. If your PC's are AD enrolled machines, then you could use a machine certificate enrolled by the internal pki with a GPO, and then set the certificate template to not allow export of the private key, then exporting the certificate won't be an easy hack for a regular user (it can be done).

Also, maybe ask the user, why they are doing this, there could be a valid reason.

[ITZEL POSADA RAMIREZ]

Hi Jan Nielsen

Don't have AD enrolled machines, is for this reason that only use eap-tls policy.

Is posible create one policy that permit only one session for CN validated in certificate?

And the reason because the users are doing this is for use personal device. This isn't permit.

Thanks

[jan.nielsen · Accepted solution]

So, if they are not AD enrolled, how are you installing the certificates on them, or are users doing this themselves, are they windows pc's or all sorts of machines ?

As i said earlier, there is no way of restricting an identity from having more than one session, in this scenario. Only when using guest access with central web auth in ISE, is it possible to do this kind of restriction, and it is normally just used to only let the guest be online with one device at a time, not to restrict which devices they can use, however it does not work for 802.1x authentication.

One way, to limit the problem, could be to include the mac address of the device in the certificate (which can be done with BYOD provisioning of certs with ISE), and then check if the actual mac address sent by the device is the same as whats in the cert. This can of course be bypassed as well, but not quite as easily.

Just out of curiosity, what type of environment is this ? Enterprise, Medical,  Educational or somehing else ?

[ITZEL POSADA RAMIREZ]

The users install the certificates them. All pc's are windows.

And is educational.

Thanks for the information, I will comment the client.

Regards

[Tarik Admani]

Jan is correct if you want to add an an additional layer you can use CWA chainin where the user will be redirected to a portal to enter username and password.