Simple EAP-TLS Validation

Validation and troubleshooting– so if we look at one of these clients that we’ve connected successfully. Let’s take a look at the Intel device. We’ll go to client insight. We now have all the network related events as decline goes through DHCP obtaining DHCP resolving DNS. We then have all the authorization and association event coming from the IP, at which point we only know that we got assigned a particular VLAN 750, but nothing more than that.

But now it actually extends to the NAC authentication and authorization process. And remember our authentication flow, where first the client validates the server certificate. We see that the client is doing EAP-TLS. This is the client username. It validated the server certificate, which is signed by your organization CA by default. Then client presented its client certificate.

We see all the metadata about the client certificate. We see the common name of the certificate. We see the issuer of the certificate. Remember, we’ve created it in our other video using an open source tool.

We also see the SAN, the subject alternative name, that is equal to our common name. And we see the certificate expiry. Now finally, we see client access allowed event. This is where the request went through the authentication policy rules. It found the matching rule. It said, OK, we’re assigning VLAN 750.

And we are saying this is the rule that we’ve actually hit. This is the rule that we’ve matched during the authentication process.

So now it’s actually highlighting that this particular user went through this first rule. Since we have only one rule, there is nothing else to match, but at least we were successfully authenticated.