Solved: MacBook Pro WSA Authentication

jmhouse96 · ‎05-29-2018

I am looking for some best practice around authentication for MacBook Pro users on my network. We require authentication and would like it to be secure auth like a windows machine.

Our Current deployment uses ldap and TAC showed us the secure LDAP feature, but we do not want to decrypt all of the packets to make this work. I can enable NTLM, but when using Chrome or Firefox there is a prompt and it is sending those creds over clear text as far as I know.

I am looking for suggestions on how other authenticate these devices through the WSA because I keep seeing posts on creating auth bypass for Mac and that is not an option for me.

jmhouse96 · ‎08-06-2018

I have spent many hours on the phone with TAC and reading the Cisco documentation provided. We came to find that the biggest issue here was the EXT domian we were attempting to use was not a supported scenario for Kerberos authentication. Now I have joined the WSA to a RW DC and then pointed it to a RO DC for authentication moving forward. The RO DC has a two way trust with the WR DC as well. This is also something that TAC advised should be in place. The other major thing to mention here is in all pac files we have used in the past we pointed to an IP. You cannot use an IP address as the redirect from what I can tell for redirect.

I did find something interesting with Windows machines versus Macs. When I redirect with a Mac I can use Ironport1 as the redirect name, but with Windows I need to use Ironport1.Cisco.com. I did not do much reading as to why this is, but it is working now.

View solution in original post

Handy Putra · ‎05-29-2018

Hi,

You might consider using Kerberos authentication with MAC OS.

I have attached the tech note pdf "How to" guide for this and see if that suitable in your environment.

Regards

Handy Putra

jmhouse96 · ‎08-06-2018

I have spent many hours on the phone with TAC and reading the Cisco documentation provided. We came to find that the biggest issue here was the EXT domian we were attempting to use was not a supported scenario for Kerberos authentication. Now I have joined the WSA to a RW DC and then pointed it to a RO DC for authentication moving forward. The RO DC has a two way trust with the WR DC as well. This is also something that TAC advised should be in place. The other major thing to mention here is in all pac files we have used in the past we pointed to an IP. You cannot use an IP address as the redirect from what I can tell for redirect.

I did find something interesting with Windows machines versus Macs. When I redirect with a Mac I can use Ironport1 as the redirect name, but with Windows I need to use Ironport1.Cisco.com. I did not do much reading as to why this is, but it is working now.

jmhouse96 · ‎10-30-2018

Over the past year working with TAC it seems because of our setup there are some items that are missed when troubleshooting with TAC. I am closer to getting this to work, but now continue to hit bugs on 10.5.x code levels and waiting for an update in a little over a week to hopefully put this behind me.