I am setting up a test environment with a ACS server, switch and a windows client. This test environment will be used demonstrate and test different scenario's for our network environment.
The item that I am testing today is we have an isolated network with windows machines that are not on our Active Directory system. This is a manufacturing line that has extremely limited access to our corporate network. The goal is to allow the switches in this environment to have access to our two ACS appliances for authentication. Because the environment is isolated the machines are not apart of our domain as I mentioned before.
My ideal setup would be for the machines to do host authenticate when they boot up and once the user logs in with their profile, we will have a local user account in ACS as well. This will allow the machine to physically get onto the network if it has been turned on and no one authenticated yet. However everything that I am reading from Cisco states that I need to have a certificate between our AD system and ACS. But the machines that I want to authenticate are going to be local accounts on the ACS box and not within AD.
Is there a way to get this configuration to work? The reason I do not want to depend on MAC address authenticate is in my testing, I find that a lot of the times the network doesn't initiate in a timely enough manor if a user logs in right away, and if it doesnt come up quick enough, DHCP will fail and the machine will sit without an IP address until someone forces a renew. I cant really shorten the timers for the EAP because windows needs time to respond to the switch/servers requests. I have noticed in testing that once you type in your username/pw on the machine or let the machine do the authentication, windows starts the EAP connection and there is no waiting for a time-out to occur.
Start Free Trial
