ACS 5.1, PEAP (EAP-GTC) Machine Authentication with LDAP

[cuellar52]

Hi,

I have a

• Cisco 5508 wireless controller
  
• Cisco ACS 5.1
  
• LDAP connection
  

I have setup the wireless controller to do RADUIS authentication with the ACS 5.1 using LDAP. The setup is currently working, Brief info below on setup.

I setup the PC client to use WPA2-Enterprise AES and authentication method CISCO PEAP. When I connect to the SSID this will prompt for a username and password. I will enter in my AD details and the ACS with the LDAP connection will authenicate and on the network I go.

Now I want to add machine authentication with CERTIFICATES, each laptop and pc in our network has CA certificates installed.

Can someone please explain a way that I can add these certificates into the ACS 5.1 so I pretty much want to import them into the ACS. Once they are imported inside I want the ACS to check that the certificates are on the PC and then prompt for the AD username and password, and only once it meets these two conditions it allows the workstation onto the network.

So it will be a two form authentication one with certificates and the other ldap.

Can anyone help me out with the certificate aspect? to incorprate this into my already working LDAP setup?

[Tarik Admani]

Edgardo,

My apologies I posted the wrong link

http://www.cisco.com/en/US/tech/tk722/tk809/technologies_white_paper09186a008009256b.shtml#wp39121

Thanks,

Sent from Cisco Technical Support iPad App

[abpsoft]

Edgardo Cuellar wrote:
 is there anyway we can import this template into 2008 R2 server? 

W2k8R2 CA refusing to accept the ACS certificate request was something I wasted two hours on yesterday. The final answer to make it work was to use certreq through CMD, supplying the webserver template:

certreq -attrib "CertificateTemplate:webserver" –submit ssl.req

As Tarik already stated, the webserver template is perfectly Ok. There was just the question of how to retrofit it onto a CSR missing the MS extension to request it in the first place, and the only thing I came up with was the above statement.

HTH,

Andre.

[cuellar52]

Hi Guys,

thanks for all the replies the correct link is def what i was after, and the information from abpsoft looks like it will help out alot. My only issue is I am the network engineer and trying to get the server and systems team to help with the certicate is being a pain.

I'll message you privately Andre maybe you could help me out?

[scrye]

Thanks Tarik;

I had that annoying

"This System Failure occurred: Certificate is associated with a protocol.  Hence it cannot be deleted.. Your changes have not been save. Click OK  to return to the list page."

problem. We are mucking around with installing real certs from GeoTrust and naturally did not get it right the first time, and had to delete.

The easy fix was to take the self-signed local cert and add EAP to the proto. That let me delete the experimental GeoTrust cert, which had been configed with only EAP.

Thanks!

Steve