Configuring EAP-TLS Policies in Cisco ISE

[@brock7147]

Nice vid(s). ISE 2.7 supports TEAP (requires win10 ver 2004 for native support) with EAP chaining so you can combine user and machine authentication into one rule. Keep the vids coming sir!

[@NetworkWizkid]

Thank you Brock and thank you for watching. Yes, that is right! I am yet to upgrade my lab machines but when I do, I will probably demo this too.

[@marcokrass6924]

@@NetworkWizkid Please Link this Video in the description! :)

[@faisalaideed6959]

Excellent demonstration, Thank you for your time.

[@NetworkWizkid]

Thank you for watching.

[@devnetwise]

WOW!!! You are really an ISE Guru!

[@NetworkWizkid]

Thank you for watching

[@devnetwise]

@@NetworkWizkid You are welcome. Do you have any plan to do a video about Cisco Anyconnect VPN with ISE based on AAA and Certificate authentication? Thanks

[@NetworkWizkid]

I don't have a video yet but I do have an article here: networkwizkid.com/2019/05/26/remote-access-vpn-authentication-with-cisco-ise/ It is with the ASA but I hope that helps. I do have videos planned to cover these in more details.

[@cobeycorbitt1546]

so with the ISE where is the authentication supposed to be handled when you have a WLC connected?

[@NetworkWizkid]

Ideally those requests would be sent to ISE once all components are configured

[@georgehewitt8041]

Good video but confused how does ISE know to go down to the 2nd auth profile? Surely it will always match the first. Thanks.

[@georgehewitt8041]

Or one endpoint in first test you are using a machine cert and the other test you are using a user cert one?

[@NetworkWizkid]

Thank you for watching George. The endpoint is configured for machine and user certificate authentication. Therefore, based on the policies configured on ISE, when the machine goes through the authc process, the relevant authz rule is selected and the same is done when the user goes through the authc/authz process. This video doesn't show the endpoint configuration as the focus was on the EAP-TLS policies but I hope that makes sense.

[@georgehewitt8041]

@@NetworkWizkid Thanks! I get you it's matching on each as there different certs/authentications. I was getting confused with redirect flows. Cheers.

[@zaulisbextor3883]

hi. it is awesome. please add review from windows pc side. show and explane certificate and network card properties. where is DNS parameter you use in policy showed and other details

[@NetworkWizkid]

Hey, thank you for watching and for your feedback. I am working on some ISE training that will walk through those elements. Stay tuned for more info.

[@devnetwise]

Is it possible to create an Authorization profile based on Certificate attribute? The client is not using Wireless or Wired Dot1x authentication methods. It's about VPN users where Authentication is done by Microsoft MFA (which is working) and for Authorization I want use Certificates. Is this approach going to work? Thanks

[@NetworkWizkid]

Hey, take a look at this, it might help: community.cisco.com/t5/network-access-control/radius-authorization-only-for-client-vpn/td-p/3433218 Thanks for watching.

[@twintriode]

I don't know. I did something similar in my deployment and it has issues. 1) I authZ with external ID group computers OU for machine, and 2) in the user authZ I have external group IT OU, cert SAN, and was machine authenticated = TRUE, All of that works perfectly but, If the computer is locked and user goes home, when they return the next day the RADIUS session is ALL screwed up. If you remove the cable for a meeting when you return and go back on the wire its screwed up. I've seen recent documents of using TEAP with the native supplicant, but I hope that is still not the case because that was a thing in 2.7. Hopefully advancements have come since then. What's even more infuriating is that if there are failed authZ's the wired autoconfig service locks out for 5min (default) and will not allow any authentication attempts. I found a DWORD to modify to take that lockout to 1min, but that is the minimum....you can't turn that off. LAME!!! That didn't used to do that in old versions of Windows.

[@dereklazarus7938]

Nice vid quick question have you ran into a bug that will not allow ISE to access your policies in your policy set. I implemented my CA root certs and all of a sudden I got a weird error message 15022 Can't access policies research suggests its a bug or NTP server, AD and the ISE are not time synced so just curious if you ran into it and if so whats the fix. I work off a VM in production and would like to not have to rebuild it because everytime I do I have to get licensing updated for the new UID and getting in contact with those guys can be annoying....thoughts

[@NetworkWizkid]

Thanks for watching. What version of ISE and patch level are you running?

[@dereklazarus7938]

@@NetworkWizkid 2.7 no patch level which probably is the issue

[@NetworkWizkid]

If you can find the bug ID you should be able to check where the fix has been applied. Then you can plan the upgrade to that patch level or version. I assume if its a known bug and its in 2.7 then hopefully it has been fixed by now.

[@acaciofarimare]

Hi, Is it possible to configure ISE EAP Authentication in Multiple Domain? Both domains have separate Windows CA servers, how does this work with EAP Authentication ? As far as I can see you cannot use EAP authentication on multiple system certificates

[@NetworkWizkid]

So are you saying that machines are issued with CA's from both domains or are you saying that some machines have CA certificates from one domain and some have certificates from other domains?

[@acaciofarimare]

@@NetworkWizkid exactly, the problem is how I'm going to put on the ISE two EAP certificates from different CAs so that the ISE can validate both CAs when a machine tries to authenticate itself. this link represents exactly my problem community.cisco.com/t5/network-access-control/ise-eap-tls-authentication-of-devices-from-two-different-domains/td-p/4058420

[@NetworkWizkid]

As mentioned in the comments in the link that you've shared, this shouldn't be an issue. The two CA's of the servers would be added to ISE' trusted certificates store and then you would integrate both AD's as external directories within ISE before creating policies to look for or match on the certificates attributes. Hope this helps :-) and thank you for watching. Please subscribe if you haven't do so already.

[@andretrouw6156]

Nice Video !

[@NetworkWizkid]

Thank you and thank you for watching.

[@devnetwise]

Will you create a video to integrate Cisco ISE with AnyConnect VPN & Microsoft Azure MFA? Thanks

[@NetworkWizkid]

I will if I have access to the Azure MFA, if not I will look at doing one with Duo

[@devnetwise]

@@NetworkWizkid I hope you can get access to Microsoft MFA because there is a lot of documentation and videos available as far as Cisco DUO is concerned. Thanks 👍🏾