We have a chicken & egg situation where ISE requires a user's login and the presence of a user cert from AD before the user can be permitted to connect to the corporate wifi. But the user needs to connect to wifi to get the cert.
One solution i have read is to have a 2 phase login. A user with just an AD machine member cert will fail the standard login. ISE can then drop through to a secondary auth which requires user/pass & machine cert. When this is successful, user is dropped into a staging vlan on their switch+AP. The staging vlan only allows connection to what is needed to load the required cert. Group policy and login scripts will recognise the presence of the staging vlan, load the client with the needed cert, and then reboot the client.
I'm using ISE v3.2 and a 9800 vWLC. Assuming flexconnect mode for APs with local switching at the AP end, i cant see how to get an AP+SSID to drop a single client into different vlans depending on auth results. Is there a guide available for this kind of thing?
