You are here
SEC0273 - ISE 2.2 Wired 802.1X with EAP-TLS and PEAP (Part 2)
Difficulty Level:
Lab Document:
<Please login to see the content>
Category:
Security
Video Download:
Title: SEC0273 - Video Download $17.00
The video walks you through configuration of wired 802.1X using EAP-TLS and PEAP on Cisco ISE 2.2. We will configure authentication and authorization policies to support both user and machine authentications and enforce Machine Access Restriction (MAR) using Windows Native Supplicant. DACL will be used to restrict network access. We will perform testing on both domain, and non-domain computers and observe authentication results.
Part 2 of this video covers configuration validation with endpoint testing
Topic:
- Network Device and Group
- Certificate Profile (Common Name)
- Active Directory User Group
- Identity Source Sequence
- User and Machine Authentication with EAP-TLS and PEAP
- Windows 802.1X Native Supplicant
-
Policy Element Result
- Authorization (Downloadable ACL)
- Authorization (Authorization Profile)
- Authentication Policy
- Authorization Policy
-
Policy Set
- Authentication Policy
- Authorization Policy
About Author
Metha Chiewanichakorn, CCIE#23585 (Ent. Infra, Sec, SP), is a Cisco networking enthusiast with years of experience in the industry. He is currently working as a consulting engineer for a Cisco partner. As a founder of and an instructor at labminutes.com, Metha enjoys learning and challenges himself with new technologies.
2 comments
EAP-TLS auth for new user
Hi Metha,
Thanks so much for your wonderful videos! I have learnt so much from your videos.
I do have some questions re EAP-TLS user auth for new user who doesn't have a certificate yet.
How would you do this for new user? because it's like a chicken and egg scenario where user can't authenticate on the network because this depends on the user having certificate, but for the certificate to be distributed the user needs to login and download it using Group Policy.
In your video, the user already has a certificate.
Also, is the user authenticating using PEAP with EAP-TLS? or just EAP-TLS?
Thank you
EAP-TLS auth for new user
Assuming it is a corporate computer, the computer should already have cert installed which allow machine auth to succeed and have access to AD. When a new user comes along, he/she can login and pull down user cert. For any other non-domain computer, you need to find another way to provision cert like MDM.