EAP-TLS with Azure: validation & WxLAN integration

INSTRUCTOR: [? Your ?] rule configured, let’s validate. Let’s take a look at which policy is now being hit for this particular user.

So we went in and did the client certificate check. Let’s just refresh those events so we see them.

All right, so we went in and client trusted the server cert. We trusted the client cert.

We then did an IDP lookup, right? Same thing as your ID. We got the three IDP roles. Now, let’s look at this client access allowed.

We got the VLAN 750. We got the user group or role called employee. And now we are actually hitting that different rule now. Because we have this additional context, additional visibility from the IDP, we can now do differentiated access policies for our clients.

Now, what you could do with this employee role– how can you use it on the wireless side?

You could go to organization labels. You can create a label AAA attribute. Let’s call it “Employee.” You’ll match on the user group.

And what you’ll do, you could go to your WLAN template.

You can create a network policy now. You can say, OK, if the user is part of this employee role or employee group, we can now decide which resources it can or cannot access on the network. So we can say, OK, let’s probably block Facebook for employees and hit Save. This is how you can extend the role that’s being supplied by the NAC and then apply it on the AP to do some additional restrictions on which resources the user is able to access.