Strip domain name in PEAP Authentication

Is there ny chance to strip domain name (domain\username) in PEAP Authentication?

We need to configured the proxy distribution to strip the domain name from the username
before checking the database. Lets say Our domain name is SERVNET. We need to have
configured Character String "SERVNET\ " , Position "Prefix" , Strip "Yes " Forward to
local server. When the users authenticate via 802.1x (PEAP), the domain name is stripped
from the username.
Also please checkout this bug CSCeg01533 before you try it.
Regards,
~JG
Do rate helpful posts

Similar Messages

How do I get IE to drop the domain name from authentication responses

All,
I have a number of internal www servers that run various non MS operating systems which are not tied to the windows domain in any way. They are secure www sites and require authentication.
When I connect to one via IE on a domain joined workstation or server (ie 8 & 9) I am unable to authenticate because I can not remove the domain name from the authentication credentials that IE is passing back to the www server. I get an authentication
prompt for user name & password with the domain pre populated.
How the heck to I get IE to NOT pass the domain name as part of the authentication process. I've tried putting .\ in front of the user name but to no avail.
Thanks,
Steve D.

As you can see below, when you first attempt the auth it defaults to you domain user account... in this case win\username.
When you select use another account, you get the following with no means to remove the domain name which causes auth failure as this www server isn't a domain member and doesn't use the domain for auth.
How do I get rid of Domain: .... ???
Thanks,
Steve D.

IronPort WSA with Authentication unable to access 2 character domain names with 2 character TLDNs

I've discovered an issue requiring user authentication and some of the short url sites likes e2.ma will not load in Internet Explorer explicitly configured to go through an IronPort WSA. In testing with bogus domains (a.to, aa.to) it seems the issue is if the domain name is 1-2 characters and the top level domain name is also 2 characters long. Longer domains (aaa.to) work and return an IronPort error for DNS_FAIL. Does anyone know of a workaround to not have to allow all these as unauthenticated destinations?

Support pointed me towards that KB article as well, but it is for IE 5 (and fixed in IE 6), but IE 8+ uses a TLD list from Microsoft (visible by using res://urlmon.dll/ietldlist.xml) and I don't control the external website. I'm going to try using an IP address surrogate instead of session cookies for these domains and see if that resolves this.

Getting list of domain names on NT, and authenticating user

Hello, I want to make an class that will check the user login name and password on a NT domain, the class will show a screen with 2 fields, username and password, and a combobox, with all domain names, on this screen the user will type his username and password and choose a domain to login to, the class will then check if he can login to that domain.
Currently the problem I have is that I couldn�t find a way to get a list of domain names.
And after I get that list, what is the best way to authenticate the user ?
Thanks a lot in advance for any help.

hi,
you can ask for username, password by running this code:
String auth = httpRequest.getHeader("Authorization");
if (auth == null)
httpResponse.setStatus(httpResponse.SC_UNAUTHORIZED);
httpResponse.setHeader("WWW-Authenticate", "NTLM");
httpResponse.flushBuffer();
return;
if (auth.startsWith("NTLM "))
byte[] msg = new sun.misc.BASE64Decoder().decodeBuffer(auth.substring(5));
int off = 0, length, offset;
if (msg[8] == 1)
byte z = 0;
byte[] msg1 = {(byte)'N', (byte)'T', (byte)'L', (byte)'M', (byte)'S', (byte)'S', (byte)'P',
z,(byte)2, z, z, z, z, z, z, z,(byte)40, z, z, z,
(byte)1, (byte)130, z, z,z, (byte)2, (byte)2,
(byte)2, z, z, z, z, z, z, z, z, z, z, z, z};
httpResponse.setHeader("WWW-Authenticate", "NTLM " +
new sun.misc.BASE64Encoder().encodeBuffer(msg1));
httpResponse.sendError(httpResponse.SC_UNAUTHORIZED);
return;
else if (msg[8] == 3)
off = 30;
length = msg[off+17]*256 + msg[off+16];
offset = msg[off+19]*256 + msg[off+18];
String remoteHost = new String(msg, offset, length);
length = msg[off+1]*256 + msg[off];
offset = msg[off+3]*256 + msg[off+2];
String domain = new String(msg, offset, length);
length = msg[off+9]*256 + msg[off+8];
offset = msg[off+11]*256 + msg[off+10];
String username = new String(msg, offset, length);
You can put this code in youe servlet or in a filter.
I am also strucked with similar problem.
With this code i am getting the window to enter loginId/password but i am not able to authenticate it.
If you have found any solution to authenticate the user please help me.
i am really strucked.
thanks in advance
Pamjoshua

PEAP authentication problems

Hi,
I configured a Cisco AP 1200 IOS with PEAP.
Hereby the AP Config:
aaa new-model
aaa group server radius rad_eap
server 192.168.4.58 auth-port 1645 acct-port 1646
aaa group server radius rad_mac
aaa group server radius rad_acct
aaa group server radius rad_admin
aaa group server tacacs+ tac_admin
aaa group server radius rad_pmip
aaa group server radius dummy
aaa authentication login eap_methods group rad_eap
aaa authorization exec default local
aaa authorization ipmobile default group rad_pmip
aaa accounting network acct_methods start-stop group rad_acct
aaa session-id common
dot11 arp-cache optional
bridge irb
interface Dot11Radio0
no ip address
no ip route-cache
encryption vlan 184 key 1 size 128bit 7 xxxx transmit-key
encryption vlan 184 mode wep mandatory mic key-hash
encryption key 1 size 128bit 7 xxxxx transmit-key
encryption mode wep mandatory
broadcast-key vlan 184 change 3600
ssid test
vlan 184
authentication open eap eap_methods
authentication network-eap eap_methods
world-mode
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
rts threshold 2312
station-role root
dot1x reauth-period 1800
dot1x client-timeout 1800
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
interface Dot11Radio0.184
encapsulation dot1Q 184
no ip route-cache
bridge-group 184
bridge-group 184 subscriber-loop-control
bridge-group 184 block-unknown-source
no bridge-group 184 source-learning
no bridge-group 184 unicast-flooding
bridge-group 184 spanning-disabled
interface FastEthernet0
no ip address
ip accounting output-packets
no ip route-cache
speed 100
full-duplex
interface FastEthernet0.3
encapsulation dot1Q 3 native
no ip route-cache
bridge-group 1
no bridge-group 1 source-learning
bridge-group 1 spanning-disabled
interface FastEthernet0.184
encapsulation dot1Q 184
no ip route-cache
bridge-group 184
no bridge-group 184 source-learning
bridge-group 184 spanning-disabled
interface BVI1
ip address 192.168.4.98 255.255.254.0
ip accounting output-packets
no ip route-cache
ip default-gateway 192.168.4.3
ip http server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag/ivory/1100
ip radius source-interface BVI1
radius-server local
radius-server host 192.168.4.58 auth-port 1645 acct-port xxxx key xxx
radius-server timeout 120
radius-server deadtime 1200
radius-server domain-stripping
radius-server attribute 32 include-in-access-req format %h
radius-server authorization permit missing Service-Type
radius-server vsa send accounting
bridge 1 protocol ieee
bridge 1 route ip
bridge 184 protocol ieee
W're using a Cisco Wireless client adaptor with the latest ACU version fully installed and configured my client for PEAP. I also configured the Windows XP network settings appropriately.
The RADIUS we are using is a Cisco ACS 3.2.1. We used a Microsoft certificate for the server that we issued ourselves.
Without configuring security, the client can associate with the AP, but when we enable PEAP and I open the ACU status screan, the client associates with the AP, but canot authenticate successfully. Status hangs on 'autenticating'. I don't see any traffic to the RADIUS server.
Who can help us?
Thanks in advance!

I just opened a TAC case on this one whereby I have already installed the latest client, made sure PEAP is installed, had the latest WAP image, network security setup on the ACU as per the documentation to select the "host base EAP(802.1x) and select dynamic wep, then turned on debug options on the WAP to see the communication between the client and the WAP:
debug radius authentication
debug dot11 aaa dot1x process
debug dot11 aaa dot1x state-machine
Guess what... there is no communication between the client and the wap for authentication. You can see association and even get an ip address from dhcp but...
The advise as per the TAC engineer is to put in a Static WEP key for now and you should get the communication going. They have already noticed this on some calls and have not seen a bug case # assigned to it. They will be working a fix on the next release. Once you do that you should see the Raduis and 802.1x communication going on.
After doing this I can then concentrate on why I am not getting PEAP authenticated on our Funk Radius EE Server v4.7.
The other thing...remove the "authentication network-eap eap_methods" when you are doing PEAP. You enable that for LEAP so you have to create a different vlan for that.
I use 1812/1813 for the radius server.
:-) Ed

DNS Domain name ISE 1.2

Question: Can the DNS domain name in ISE 1.2 be differnt from the AD domain that ISE is joined to?
Situation: I have an internal AD domain 'mydomain.local'. Currently ISE is setup with mydomain.local as it's dns domain it's FQDN is isebox.mydomain.local, it is also joined to that domain. The problem comes with the certificate for HTTPS sites (management, guest, etc...) specifically guest. If I use a certificate for isebox.mydomain.local, guest users (that do not have our internal ca) will get a certificate error. The certificate used for HTTPS sites in ISE has to match the hostname of ISE. This seems to me to be an unresolvable problem. I have to have mydomain.local as the DNS domain, so that I can join ISE to mydomain.local. But if I use that domain then I can't issue a public cert for the ISE box, because I can't get a public cert for a .local domain.
My idea was to define the DNS domain as a public domain (abc123.com) but still join it to my internal domain (mydomain.local). I have found some vauge references to this not being a supported configuration, and even that it doesn't work at all. Could someone please tell me if this works? Or better yet, some better/easer way to solve this prolem.
Thanks!

Hello John
Cisco ISE supports integration with a single Active Directory identity source. Cisco ISE uses this Active Directory identity source to join itself to an Active Directory domain. If this Active Directory source has a multidomain forest, trust relationships must exist between its domain and the other domains in order for Cisco ISE to retrieve information from all domains within the forest.
However, you may create multiple instances for LDAP. Cisco ISE can communicate via LDAP to Active Directory servers in an untrusted domain. The only limitation you would see with LDAP being a database that it doesn't support PEAP MSCHAPv2 ( native microsoft supplicant). However it does suppport EAP-TLS.
For more information you may go through the below listed link
http://www.cisco.com/en/US/solutions/collateral/ns340/ns414/ns742/ns744/docs/howto_45_multiple_active_directories.pdf

How to change the name / IP address and domain name for BOE Server

Hello,
We want to change the name / IP address and domain name for BOE Server, please could you indicate the steps or procedure to follow?
I need your help
thank you

If it's 3.1 just change them, shouldn't cause any issues if by domain name you are referring to changing the domain the computer belongs to. If you are changing your domain for AD authentication then you will may have to take quite a few steps if the old domain is going away. Let us know.
Regards,
Tim

MVC OWIN Application hosted in Azure fails with custom domain names

I am not entirely sure if this is the proper forum for OneDrive API questions, but hoping this is close enough or can be redirected.
I am working on integrating Microsoft Account authentication into my application, and in testing have based it off of the VS 2013 MVC starting template. Everything works fine if I set my target domain and redirect url to be sitename.azurewebsites.net
/ sitename.azurewebsites.net/signin-Microsoft respectively.
However, this site has a custom domain associated with it, so I would like to actually point to use
www.sitename.com /
www.sitename.com/signin-Microsoft under my dev account settings for this application. When I am in this configuration, I consistently get the following error:
We're unable to complete your request
Microsoft account is experiencing technical problems. Please try again later.
Accessing www.sitename.com works fine. How can I configure this to work with my actual domain name versus the azure name?
Thanks in advance!

Hi Rob,
Can you contact me at [email protected] with the actual domain name that you are trying to register so that I can take a closer look?
Thanks,
Toan

How to determine the Current Domain name from inside an Mbean / Java Prog

We have registered an Application Defined MBean. The mbean has several APIs. Now we want to determine the currrent domain using some java api inside this Mbean. Similarly we have deployed a Webapp/Service in the Weblogic domain. And inside this app we need to know the current Domain. Is there any java api that will give this runtime information.
Note: We are the MBean providers not clients who can connect to the WLS (using user/passwd) and get the domain MBean and determine the domain.
Fusion Applcore

Not sure if this will address exactly what you are looking to do, but I use this technique all the time to access runtime JMX information from within a Weblogic deployed application without having to pass authentication credentials. You are limited, however, to what you can access via the RuntimeServiceMBean. The example class below shows how to retrieve the domain name and managed server name from within a Weblogic deployed application (System.out calls only included for simplicity in this example):
package com.yourcompany.jmx;
import javax.management.MBeanServer;
import javax.management.ObjectName;
import javax.naming.InitialContext;
public class JMXWrapper {
    private static JMXWrapper instance = new JMXWrapper();
    private String domainName;
    private String managedServerName;
    private JMXWrapper() {
    public static JMXWrapper getInstance() {
        return instance;
    public String getDomainName() {
        if (domainName == null) {
            try {
                MBeanServer server = getMBeanServer();
                ObjectName domainMBean = (ObjectName) server.getAttribute(getRuntimeService(), "DomainConfiguration");
                domainName = (String) server.getAttribute(domainMBean, "Name");
            } catch (Exception ex) {
                System.out.println("Caught Exception: " + ex);
                ex.printStackTrace();
        return domainName;
    public String getManagedServerName() {
        if (managedServerName == null) {
            try {
                managedServerName = (String) getMBeanServer().getAttribute(getRuntimeService(), "ServerName");
            } catch (Exception ex) {
                System.out.println("Caught Exception: " + ex);
                ex.printStackTrace();
        return managedServerName;
    private MBeanServer getMBeanServer() {
        MBeanServer retval = null;
        InitialContext ctx = null;
        try {
            //fetch the RuntimeServerMBean using the
            //MBeanServer interface
            ctx = new InitialContext();
            retval = (MBeanServer) ctx.lookup("java:comp/env/jmx/runtime");
        } catch (Exception ex) {
            System.out.println("Caught Exception: " + ex);
            ex.printStackTrace();
        } finally {
            if (ctx != null) {
                try {
                    ctx.close();
                } catch (Exception dontCare) {
        return retval;
    private ObjectName getRuntimeService() {
        ObjectName retval = null;
        try {
            retval = new ObjectName("com.bea:Name=RuntimeService,Type=weblogic.management.mbeanservers.runtime.RuntimeServiceMBean");
        } catch (Exception ex) {
            System.out.println("Caught Exception: " + ex);
            ex.printStackTrace();
        return retval;
}I then created a simply test JSP to call the JMXWrapper singleton and display retrieved values:
<%@page contentType="text/html" pageEncoding="UTF-8"%>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
   "http://www.w3.org/TR/html4/loose.dtd">
<%@ page import="com.yourcompany.jmx.JMXWrapper"%>
<%
   JMXWrapper jmx = JMXWrapper.getInstance();
   String domainName = jmx.getDomainName();
   String managedServerName = jmx.getManagedServerName();
%>
<html>
    <head>
        <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
        <title>JMX Wrapper Test</title>
    </head>
    <body>
        <h2>Domain Name: <%= domainName %></h2>
        <h2>Managed Server Name: <%= managedServerName %></h2>
    </body>
</html>

How can I find the currently logined domain name on Windows??

Dear,
I've a program that query some user account information from A.D.
But I don't want to hard code anything.
I've read some previous post about using LDAP, and using DNS queries to found all LDAP server of A.D.
But how can I get the A.D. domain name in Java?
for example
ldcp://_ldap._tcp.xxxx.yyyy
I want to get "xxxx.yyyy" from the logined user account. It is possible in Java.

You coud use the NTSystem class to derive the NetBIOS domain name, however without doing some gymnastics it isn't easy to derive the fully qualified domain name. import java.io.*;
import com.sun.security.auth.module.NTSystem;
class NTDomain {
     public static void main(String[] args) {
          NTSystem system = new NTSystem();
          String domain = system.getDomain();
          System.out.println("Domain: " + domain);
}The only other alternatives could be to check the domain suffix of the user principal that was authenticated via Kerberos ....
lc = new LoginContext(searchkrb5.class.getName(),new SampleCallbackHandler());
     lc.login();
     catch (LoginException le) {
          System.out.println("Logon failed: " + le);
          System.exit(-1);
     System.out.println("Authenticated via GSS-API");
        System.out.println("User: " + lc.getSubject().getPrincipals().toString); however I think that you still have to specifify the Kerberos realm in the apps configuration file.
Another alternative could be to make assumptions about the machines hostname, however one day an assumption will always be proven wrong, (eg. The machine's DNS domain name does not need to match the Active Directory domain).
Unless there is a Java API to read the Windows registry or extract Kerberos ticket information from the WIndows Kerberos ticket cache, you may be kind of stuck.

RDP on Domain Name

Hi Team,
I have a Q? Is this possible we type "mstsc" in run and then Type may domain name and get an "rdp" session of one of the server.
and this is happening to different server form different user and desktop.
Please help....

Hi Vinod.Dhiman,
If you use the domain name as the RDP destination server, you may log on any possible DC, more detail about the DC locating please refer the following KB:
Domain Controller Locator
http://technet.microsoft.com/en-us/library/cc961830.aspx
More information:
How Can I Determine Which Domain Controller Authenticated a User?
http://blogs.technet.com/b/heyscriptingguy/archive/2005/06/15/how-can-i-determine-which-domain-controller-authenticated-a-user.aspx
I’m glad to be of help to you!
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

EAP-TLS or PEAP authentication failed during SSL handshake

Hi Pros,
I am a newbie in the ACS 4.2 and EAP-TLS implementation, with that being said. I face an issue during a EAP-TLS implementation. My search shows that this kind of error message is already certificate issue;However, I have deleted and recreated the certificate in both ACS and the client with the same result. I have deleted and re-install the certchain as well.
When I check my log in the failed attemps, there is what I found:
Date
Time
Message-Type
User-Name
Group-Name
Caller-ID
Network Access Profile Name
Authen-Failure-Code
Author-Failure-Code
Author-Data
NAS-Port
NAS-IP-Address
Filter Information
PEAP/EAP-FAST-Clear-Name
EAP Type
EAP Type Name
Reason
Access Device
Network Device Group
06/23/2010
17:39:51
Authen failed
000e.9b6e.e834
Default Group
000e.9b6e.e834
(Default)
EAP-TLS or PEAP authentication failed during SSL handshake
1101
10.111.22.24
25
MS-PEAP
wbr-1121-zozo-test
Office Networ
06/23/2010
17:39:50
Authen failed
[email protected]
Default Group
000e.9b6e.e834
(Default)
EAP-TLS or PEAP authentication failed during SSL handshake
1098
10.111.22.24
25
MS-PEAP
wbr-1121-zozo-test
Office Network
[email protected] = my windows active directory name
1. Why under EAP-TYPE it shows MS-PEAP not EAP-TLS? I did configure EAP-TLS....
2. Why sometimes it just shows the MAC of the client for username?
3. Why it puts me in DEFAULT-GROUP even though i belongs to a group well definy in the acs?
2. Secondly, When I check in pass authentications... there is what i saw
Date
Time
Message-Type
User-Name
Group-Name
Caller-ID
NAS-Port
NAS-IP-Address
Network Access Profile Name
Shared RAC
Downloadable ACL
System-Posture-Token
Application-Posture-Token
Reason
EAP Type
EAP Type Name
PEAP/EAP-FAST-Clear-Name
Access Device
Network Device Group
06/23/2010
17:30:49
Authen OK
groszozo
NOC Tier 2
10.11.10.105
1
10.111.22.24
(Default)
wbr-1121-zozo-test
Office Network
06/23/2010
17:29:27
Authen OK
groszozo
NOC Tier 2
10.11.10.105
1
10.111.22.24
(Default)
wbr-1121-zozo-test
Office Network
In the output below, it says that the user is authenticate and it puts the user in the right group with the right username, but the user never really authenticate. Maybe for the first few seconds when I initiate the connection.
Before I forget, the suppliant is using WIN XP and 802.1x is enable. I even uncheck not verify the server and the ACS under External User Databases, I did check ENABLE EAP-TLS machine authentication.
Thanks in advance for your help,
Crazy---

Any ideas on this guys?? In my end, i've been reading some docs... Things started to make sens to me, but I still cannot authenticate, still the same errors. One more thing that catch my attention now is the time it takes to open a telnet session to cisco device which has the ACS for auth server.
My AD(Active Direct) and the ACS server are local same subnet(server subnet). Ping to the ACS from my desktop which is in different subnet is only take 1ms. To confirm that the issue is the ACS server, I decided to use another server in remote location, the telnet connection is way faster than the local ACS.
Let's brain storm together to figure out this guys.
Thanks in advance,
----Paul

ISE Domain Name, Certificates and Guest Portal

Hi everyone,
We have an ISE deployment using our internal domain for its FQDN (For example: ise01.private.local). We now want to use it for authenticating guest access and have noticed the redirection URL by default uses the FQDN of the ISE server.
This works fine for our corporate machines as we have our own internal CA and generated certificates. As we do not want certificate errors occurring for our guests, we need to use a public FQDN.
Are we best off changing the domain-name used by the ISE servers or is there a way to edit the redirection URL to use a custom domain?
I have heard suggestions that changing the domain-name is unsupported, but I can't find any other way.
Thanks,
Mark

Mark,
Do you already have a public FQDN pointing to your ISE? If so, let's assume that you are authenticating guests using CWA. First creat a new Authorization Profile, under Common Tasks, select Web Redirection (CWA, DRW, MDM, NSP, CPP), Choose the Authentication Method (in this case, CWA) and define the ACL to be used. Just below that, select Static IP/Host Name and enter the public FQDN that points to your ISE.
From here you can create an Authorization Policy to reference the profile you just created.
Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question. Otherwise, feel free to post follow-up questions.
Charles Moreton

ISE redirect to the wrong domain name

Hello guys,
We changed a domain name of the ISE appliance and it started giving us grief. It was configured to redirect wireless users to the web registration and authentication portal. We properly added all required A records in DNS server and looked everywhere but didn't find anything that could give any clue.
Perhaps the old FQDN get stuck somewhere in the database.
Any idea? Please help !!!

Case Solution:
Connecting to the Active Directory Domain
To reconnect with Active Directory domain, complete the following steps:
Step 1                                                   Choose Administration > Identity Management > External Identity Sources.
Step 2    From the External Identity Sources navigation pane on the left, click Active Directory.
Step 3    Enter the domain name in the Domain Name text box.
Step 4    Enter a friendly name in the Identity Store Name text box for your Active Directory identity source (by default, this value will be AD1).
Step 5    Clicks Save Configuration.
Step 6    To verify if your Cisco ISE node can be connected to the Active Directory domain, click Test Connection. A dialog box appears and prompts you to enter the Active Directory username and password.
Step 7    Enter the Active Directory username and password and click OK.
A dialog box appears with the status of the test connection operation.
Step 8    Click OK.
Step 9    Click Join to join the Cisco ISE node to the Active Directory domain.
The Join Domain dialog box appears.
Step 10    Enter your Active Directory username and password, and click OK.
Step 11    Check the Enable Password Change check box to allow the user to change their password.
Step 12    Check the Enable Machine Authentication check box to allow machine authentication.
Step 13    Check the Enable Machine Access Restrictions (MARs) check box to ensure that the machine authentication results are tied to the user authentication and authorization results. If you check this check box, you must enter the Aging Time in hours.
Step 14    Enter the Aging Time in hours if you have enabled MARs.
This value specifies the expiration time for machine authentication. If the time expires, the user authentication fails. For example, if you have enabled MARs and enter a value of 2 hours, the user authentication fails if the user tries to authenticate after 2 hours.
Step 15    Click Save Configuration.
Step 16. Create Certificate Authentication Profile
Step 17: Import CA Certificates into ISE Certificate Trust Store
Step 18: Configure CA Certificates for Revocation Status Check
Step 19: Enable Client Certificate-Based Authentication
Please check below link for certificates configurations
http://www.cisco.com/en/US/docs/security/ise/1.1/user_guide/ise_admin.html#wp1122804

Cisco ISE change Domain Name

Our ISE deployment was setup with our internal domain name of csi.corp, when presenting the guest CWA this is the domain name the is presented to
the guest. We would like for this to be out public domain and a valid certificate. From what I have gathered the web portal https certificate must contain the FQDN of the ISE node, therefore I would need to change the domain name on the server(s). I have found posts that some have changed the domain name after deployment without any adverse results, is this possible? We are currently integrated with our corp AD and able to utilize this the EAP authentications. We have 2 nodes in our deployment, is it possible to change the domain name to our public domain without a rebuild?
Thanks,
Joe

Hmm, unless something has changed I don't believe this would work because:
- Even though the CN doesn't have to be an exact match of the FQDN, I believe that the domain suffix in the CN still must match the domain suffix in the FQDN. So you can have many different values and domains in the SAN fields but the domain in the CN field must match the domain specified in the FQDN. I don't have any certs to test this with now but I am pretty sure that even though the CSR generation would work, the process will fail when trying to import the cert.
- Is ".local.corp" a public domain? It doesn't sound like it but perhaps it is :) However, if it is not, then many public CAs won't issue you a public certificate for a private domain. You can definitely give it a try and see what they say :)
Let me know what you find out!
Thank you for rating helpful posts!

Strip domain name in PEAP Authentication

Similar Messages

Maybe you are looking for