View Cart
0 Items | Total: US$0.00
Welcome,      Register

You are here

Home » Security » SEC0094 - ACS 5.4 Wireless 802.1X PEAP EAP-TLS with Machine Authentication (Part 1)

SEC0094 - ACS 5.4 Wireless 802.1X PEAP EAP-TLS with Machine Authentication (Part 1)

Rating: 
4.5
Average: 4.5 (2 votes)
Difficulty Level: 
0
Lab Document: 
<Please login to see the content>
Category: 
Security

The video shows you how to configure wireless 802.1X on Cisco ACS 5.4 using PEAP and EAP-TLS. We will perform both machine and user authentications, and enforce successful machine authentication using Machine Access Restriction (MAR). We will introduces MAR Cache distribution, which is a feature introduced in ACS 5.4. For authentication, we will attempt both using AD login credential (PEAP) and client-based certificate (EAP-TLS).

Part 1 of the video focuses on configuration on the ACS.

Topic:

  • ACS Wireless 802.1X with PEAP and EAP-TLS
  • Machine Access Restriction/Distribution
  • Certificate Authentication Profile
  • Identity store Sequences
  • Policy Element
    • Authorization Profile
    • Airespance Name ACL
  • Service Selection Rule
  • Access Services
    • Authentication Policy
    • Authorization Policy
    • RADIUS Attributes
  • WLC SSID Configuration
  • Windows 7 Wireless 802.1X Network Settings
Tag: 
acs
802.1x
peap
eap-tls
wireless
radius
wlc

About Author

Metha Chiewanichakorn, CCIE#23585 (Ent. Infra, Sec, SP), is a Cisco networking enthusiast with years of experience in the industry. He is currently working as a consulting engineer for a Cisco partner. As a founder of and an instructor at labminutes.com, Metha enjoys learning and challenges himself with new technologies.
http://www.linkedin.com/in/methachiewanichakorn

8 comments

Submitted by Eric Pugh on Mon, 12/14/2015 - 07:00

In this video example are both EAP Methods be utilized to authenticate the supplicant simultaneously? Or is this two separate EAP configurations for the supplicant?

Submitted by admin on Wed, 12/16/2015 - 00:11

Here we swith the EAP config on the client between PEAP and EAP-TLS and test one protocol at a time.

Submitted by Eric Pugh on Tue, 04/12/2016 - 09:15

I get this error message (Authentication failed : 15039 Selected Authorization Profile is DenyAccess) after attempting an EAP-TLS authentication. The test supplicant never uses the ACS configured access policy rule. Hit count never changes from "0". PEAP-MSCHAPv2 works fine. Any suggestions?

Submitted by admin on Sun, 04/17/2016 - 21:41

What do you have for the policy conditions? Are you doing MAR? Try to relax it and see if you can get it to match. What version of ACS?

Submitted by Eric Pugh on Mon, 04/18/2016 - 08:31

Not doing MAR, ACS 5.4, Policy condition is Radius-IETF Framed and wireless 802.11.

Submitted by admin on Mon, 04/18/2016 - 21:39

That is strange. The auth rule is generic enough to match both PEAP and EAP-TLS. If you make the rule match anything and permit, does that at least work?

Submitted by Eric Pugh on Wed, 04/20/2016 - 08:31

Seems like my ACS 5.4 had a DB issue. Reloaded and rule started working. Can you tell me if there is a way to configure a Windows 7 supplicant to do user and computer authentication? not user or computer.

Thx...

Submitted by admin on Thu, 04/21/2016 - 23:57

Glad to hear that it is now working. You might want to take a config backup just in case. We have seen a bigger issue follows when an issue like this starts to happen.

'User or computer' will actually do both user and computer authentication. The way it is called is actually kinda misleading.

Poll

Vote for the Next Video Series