0

The hardware is Cisco APs and Windows 7 Enterprise clients, which currently allows users to authenticate based on an Access Group in AD.

We're looking at instead of users account, using the actual computer, so we can control what machines can authenticate to the APs, rather than users.

Is this a native functionality?

1 Answer 1

0

I'm not sure if I'd call it a 'native' functionality, but its not an uncommon thing to do.

The basic mechanism by which you would accomplish this type of authentication is to use machine certificates. By leveraging your active directory as a PKI environment, you can deploy machine certificates to every Windows machine.

Once you have deployed machine certificates, you'll configure a RADIUS server like Cisco ACS or Cisco ISE that will perform EAP-TLS authentication against those certificates.

So you'll set up your SSID to perform EAP-TLS authentication, point the authentications to Cisco ISE, and install the root chain certificate from Active Directory on your ISE machine and set up a few rules that authenticate and authorize access when a valid certificate is presented. Finally you'll configure your Windows machines to connect to the SSID using EAP-TLS and to offer their machine certificate during that authentication process.

If you've never done any of this, you'll either want a fair amount of lab time or better yet find a Cisco partner to help you set it up. It's not terribly difficult but there are a fair amount of moving parts that make it more complicated than just a checkbox or something.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .