My EAP-PEAP Setup

[jain.manish94]

Hello Team, 

I have setup EAP-PEAP. 

1. created one corp-ssid for all the users. 

2. define setting under the gpo policy which is pushing from AD end to all the laptops. 

3. i am broadcasting the SSID from my WLC. 

now my concern here that when user using their personal laptop still they can see that Corp-SSID and they know about their AD credentials as well and they are connecting successfully. 

i did not get why this is happening or any more configuration over the cisco ise or AD GPO policy. 

Could you please suggest me. 

under the cisco ISE authentication Policy -- i only define Wreless_802.1x --- AD

authorization policy --- wireless_802.1x and SSID name. thats it. 

GPO --- there is eap-peap, AES, MSCHAPv2, root certificate. 

Thanks

Manish Jain 

[Sandeep Choudhary]

To stop private laptops on your network, you must use the EAP-TLS protocol, but you must installed certificate on your corporate laptops.

More info here:

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/213543-configure-eap-tls-flow-with-ise.html

Regards

Dont forget to rate helpful posts

[jain.manish94]

can not use this please give me eap-peap solution for no-domain laptop. 

[ammahend]

Agree with Sandeep, eap-tls is a good way to go, if you can not do this immediately then you can also add an additional condition, checking if machine was authenticated against AD domain computers, that way only domain machines can join and personal devices won’t. 

[jain.manish94]

how to configure this and where i need to configure this. 

over cisco ise ? or AD

could you please suggest configuration which i need to to. 

[ammahend]

This is fairly old but the concept still applies,  for wireless you will have to setup the supplicant bit differently to do authentication before logon. But you can start here. 

https://youtu.be/raDFQDTt9uY

if you have any connect supplicant installed on machines then it would be even better, then Google or YouTube for eapchaining. 

tone of good ise resources are available here on community

https://community.cisco.com/t5/security-documents/cisco-ise-amp-nac-resources/ta-p/3621621

[Arshad Safrulla]

EAP-PEAP is considered obsolete due to multiple reasons.

1. Vulnerable to certain attacks when not properly configured.

2. Windows credential guard behavior impacts EAP-PEAP in the newer updates of Windows 

As other suggested check the possibility of using EAP-TLS, otherwise you also have the option of doing posturing using anyconnect+ISE or use your endpoint management platform to restrict connectivity.

[jain.manish94]

can not use EAP-TLS because there are 2000 users and don have 2000 user certificate.

Can you please help to setup eap peap without any issue.

One more thing I am not understanding that one laptop or system is part of workgroup how it can be connected to our corporate SSID if this SSID is visible to all.

Because until and unless you will join the domain with your laptop how u will get that GPO policy for corporate wifi.

[Arshad Safrulla]

I assume that you have a Microsoft AD infra working, if yes why not just use it's CA services and automate the complete certificate issuing process using a GPO. It's very few clicks here and there if you know what to do. You will not be paying for the certs as these are issues by your own enterprise CA (not from public CA)

[jain.manish94]

Yes this is from our internal CA but again confused now because I am thinking that here also we have to buy some licence to all the user if we use EAP-TLS.

Who will provide user certificate to all the corporate device?

If only root certificate is required then what is difference between eap peap and eap TLS?

As per my knowledge i think eap TLS required some extra hardware and computing power to provide client certificate to each devices if using eap TLS.