ACS 5.5 802.1X authentication based on certificate issuer

[Allen Spoon]

Is it possible to do 802.1X authentication with ACS 5.5 based on the client machine certificate issuer (without joining the ACS to AD)?

Example, If the client machine has a certificate loaded that was issued by a certain authority, allow it access.

Our AD admins will not let us join our ACS to the domain.

[Peter Koltl]

Yes, you can use EAP-TLS via LDAP (but not PEAP-MSCHAPv2).

[Alban H]

Hi Allen,

We managed to have port based NAC solely based on certificates and with Cisco switches. It also not fully tested, but basic use cases are working (e.g. device with wrong or no certificate are rejected, and devices with a certificate gets connected). I will need sometime to write the howto but if you already have particular questions, I will be happy to help.

[Allen Spoon]

Awesome. That would be very helpful.