Hi Tarik, Is user connected to the network and can it access the domain controllers after machine authentication succeeds? YES, The assigned VLAN can reach DCs. Also do you have the nac agent installed on this device as well?(Anyconnect with NAM) Are you changing vlans after user authentication? I wanted to but its not working. Thanks, ... View more

Thanks for your help Tarik, I have changed the NAM profile as you suggested but still only one user can login successfully. When I login with diffrent user it still not working. However, ISE authentication logs shows successfull with correct Authz profile. NAM still throws same error "limited connectivity". Thanks in advance. ... View more

Hi Tarik, I have tried using Cisco Anyconnect NAM on Wondows XP for machine and user authentication but EAP-chaining feature is not working as expected. I am facing few challenges. I have configured NAM to use eap-fast for machine and user authentication and ISE is configured with required authorisation rule and profiles/results. when machine boots up it sends machine certificate and gets authenticated against AD and ISE matches the authorisation rule and assigns authZ profile without waiting for user credentials. Now when a user logs on using AD user/pass, authentication fails as the VLAN assigned in AuthZ profile does not have access to AD. ISE should actually check with their external database but Its not. Interestingly, if I login with an AD user which is local to the machine its gets authenticated and gets correct AuthZ profile/access level. If I logoff and login with different user, Windows adapter gets IP address and ISE shows successful authentication /authz profile but NAM agent prompts limited connectivity. Any help?? ... View more

Hi Tarik, thanks for your support. I will try Anyconnect and hope We can achive machine and user authentication same time before ISE applies authorisation profile/rules. Thank you. Sent from Cisco Technical Support Android App ... View more

Hi Tarik, Certificate check is working now. But as I suspected earlier, machine AND user authentication is not working. If i set XP supplicant authmode to use machine only authentication then machine gets authenticated agianst certificate profile and ISE assigns authorisation profile without checking username and password.which is not desirable. If I set XP authmode to " Always perform user authentication when user logs on" then I can see machine authenticates in ISE but after login with AD username and password , connection doesnt come up and XP pops up with" windows cant find user cert" error. How to make user and machine authentication work at the same time? one more thiing I noticed that after machine authentication, EAP is not challenging for username and password. I have enabled MAR in ISE. Am I missing something. Thanks in advance and I will surely rate your posts. ... View more

Will both work with MS XP default supplicant? any document ... Thanks again for your support. Sent from Cisco Technical Support Android App ... View more

that means machine and user authentication is not dome at the same time. ??? it will check only machine name instead of username in AD database for certificate verification.then how user authentication can be achieved after machine authentication?? ... View more

Tried that as well but not working.Surely looks some prob with AD config. But if the certificate profile pass then will it check username and password against AD? Thanks for your support. ... View more

the requirement: 1:corp asset + AD user/pass=full access ,2: BYOD + AD user/pass= partial access.both using EAP and same ssid. I have configured authentication policy based on this requirement using identity source sequence which has certificate profile (which checks certificate agianst AD) and AD external database for username and pass verification. AD guys have made changes according to microsoft doc but still same error.am I missing something somewhere??? ... View more

Hi Tarik, I have two CA server certificates installed in ISE. One is Public CA and the other is internal MS CA. I want corp assets to use MS CA and BYOD to use public CA. I have enabled EAP for public CA. So when I enable "Verify server certificate" check on client machine it rejects ISE and EAP does not establish but it works for BYOD. As I can only specify one CA for EAP , I have to disable server verification. Its understood that machine is supplying local MS CA certificate while ISE sends Public CA server certificate and EAP-TLS fails. But after disabling server verification , it gives error for bianry comparison failed. Is it possible to use two different CA for two different authentication rules? other thing is public cer for ISE is assigned by intermediate CA so I have installed intermediate cert chain certificate in ISE certificate store. Do I need to also install public Root CA cert in ISE certificate store? How should the chain be installed?any sequence of uploading CA certs? Thank You, ... View more

Hi Tarik, Thanks for your reply. Yes,ISE have a sigend certificate from the same internal CA in ISE certificate store. I will ask AD authority to follow the process mentioned in the link and update you. Thank You, ... View more