http://www.cisco.com/c/en/us/td/docs/ios/security/configuration/guide/12_4/sec_12_4_book/sec_trans_ios_fwall.html http://www.cisco.com/c/en/us/products/collateral/security/ios-firewall/product_implementation_design_guide09186a00800fd670.html
... View more
Update We have now created a self-signed certificate on the Appliance and attached it to the External interface and confirmed this certificate is persistent (does not change) after reboots of the Appliance. Also checked the Appliance's default fallback certificate and can confirm it does indeed change on every reboot of the Appliance. Something to watrch out for if you use always-on with TND and machine certificate authentication - clients fail as they do not get pop-up security alert prompting user to accept new certificate from appliance.
... View more
Tarik, The issue has now been resolved with the excellent assistance of Cisco TAC - it was a configuration issue within our NAM Profile. Im summary there were 2 Network Groups within our NAM profile "Default" and "Local Networks". The profile was set correctly to use Machine Authentication for our wireless SSID in the "Default" group and was listed as an Administrator network within NAM (however as before this was failing and NAM was using the LYNC user certificate details). Turns out there had been a test network with the same SSID set-up previously within the "Local Networks" group and this was listed as a User network and it is this one that NAM was using to try and authenticate. When this test network was deleted from the "Local Networks" group we were then able to authenticate to our wireless SSID successfully using 802.1x and EAP-TLS Thanks again for your earlier help. Regards Jim.
... View more