ACS with AD-with twin authentication

[nikhilcherian]

Hi Gurus

I want to integrate my ACS 5.1 with AD, My request is to check for the machine authentication first. If the machine authentication passes the client username/password should be validated and client should be put in vlan X . If the machine authentication fails, the client username/password should be validated. If the authentication passes the client should be put in vlan Y

Let me know if this is possible

Thanks

NikhiL

[Tarik Admani · Accepted solution]

Nikhil,

You can setup a condition in your authorization policy and check if the machine authentication was performed and base your result off this condition.

Here is a guide that fits your questions:

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.1/user/guide/users_id_stores.html#wp1235978

thanks,

Tarik Admani

[nikhilcherian]

Hi Tarik,

Thansks for the reply.

below is a line i found in the doc.

Administrator can configure whether or not MAR is enabled in the AD settings page. However for MAR to work the following limitations must be taken into account:

–Machine authentication must be enabled in the authenticating protocol settings

Does this say the authenticator should enable mac-auth

Thanks

NikhiL

[Tarik Admani]

The wording on this is a little tricky, this means for machine authentication to work (PEAP or EAP-tls) you have to allow the protocol in the rule for it to work on the ACS side. When you click the on the service selection rule for default network access, you will the different protocol boxes checked.

Hope this helps,

Tarik Admani