You are here
SEC0199 - ISE 1.3 802.1X and CWA Chaining (Part 2)
Difficulty Level:
Lab Document:
<Please login to see the content>
Category:
Security
The video demonstrates a feature called 802.1X and CWA chaining on Cisco ISE 1.3. Many organization has a requirement to enforce two-factor authentication and here we will combine knowledge from previous videos to achieve this. In addition to performing 802.1X machine and user authentication, we will force our internal users to provide login credential through guest web portal. User information will be cross-checked between two methods for consistency before allow network access.
Part 2 of this video goes through testing to validate our configuration
Topic:
- 802.1X and CWA Chaining
- Endpoint Identity Group
- Guest Type
- Guest Portal
- Authentication Policy (WLAN MAB)
-
Policy Element Result
- Authorization (Named ACL)
- Authorization (Authorization Profile)
- Authorization Policy
About Author
Metha Chiewanichakorn, CCIE#23585 (Ent. Infra, Sec, SP), is a Cisco networking enthusiast with years of experience in the industry. He is currently working as a consulting engineer for a Cisco partner. As a founder of and an instructor at labminutes.com, Metha enjoys learning and challenges himself with new technologies.
15 comments
open access to get machine cert
how i can open access to the machine to get cert from CA as i am using web-redirect with DACL
this happened when the machine fail authentication
open access to get machine cert
You can exempt whatever traffic you want from the URL redirect. In this case, it would be connectivity to the CA server.
i make in DACL to permit the
i make in DACL to permit the user to access the ip of the CA and in web redirect access list make deny for this IP to deny the redirect traffic for this ip as the enrollment of the certificate need to use https after all of this the enrollment fails
after .1x faild
can i make CWA after .1x fail and COA according to the username that use input in the portal ?
after .1x faild
What do you mean by .1x fails? Fail from supplicatn supporting .1x or fail from incorrect .1x authentication. You can have MAB fallback to guest access portal so users can enter their credentials.
i tried to use CWA with Dot1x
i tried to use CWA with Dot1x , when the user that have anyconnect and we use eap-fast fail in machine authentication we give him CWA (web redirect ) then when he enter the user in the portal it give use in the portal success authentication then success in dynamic authentication but the last log give us that the user send the windows authentication and didn't match in the rule of guest flow because the use case of the user is dot1x
From what you described, it
From what you described, it appears that everything works correctly. Are you saying that User can access network after the Web portal login but somehow the .1x supplicant caused another .1x to fail and overwrite the previous successful web login?
no the user can't access the
no the user can't access the network as after i enter the user name and password in the portal the user authenticate again from user AD not use portal user
When you brought up the
When you brought up the portal, was the session a .1x or MAB at the time? Hopefully the .1X failed and failover to MAB.
the session is a .1x at the
the session is a .1x at the time
If it is .1x, you can't
If it is .1x, you can't override the .1x user credential using the portal. You will need to force .1x to fail and present portal to user using MAB.
how i can force .1x to fail
how i can force .1x to fail and present portal to user using MAB?
You configure your .1x
You configure your .1x authorization rule on ISE to DenyAccess. The switch should already be configured with both .1x and MAB so while the .1x fails, MAB should succeed.
how i configure your .1x
how i configure your .1x authorization rule on ISE to DenyAccess?
You select Deny as an auth
You select Deny as an auth profile on the policy rule