Using different CAs for different devices' cert based authentication via ISE

[wingai]

Hi there, Customer has two separate sets of devices that they want to implement certificated based authentication via ISE. One is their users' mobile devices (BYOD scenario). The other is their IoT devices (Yes, these devices are cert ready). They want to use two different CAs (AD CA for users' mobile device while ISE CA for IoT device). Is this possible and how to do that? Thanks. - William

[ognyan.totev]

Yes it is ,look here ISE Certificate Authority (CA)

[smashash · Accepted solution]

Yes.  it is possible.

first of all you need to import the Root CA (issuer CA) into ISE ( under Trusted Certificate page)

You need create two rules under policy for AD CA for users' mobile device  and IoT devices.

ISE has several attributes to differentiate  these two flows  ( e.g. BYODRegistration flag   for BYOD flow  or using Certificate (Issuer CA) attributes,device location or group ...)

here is an example:

YYes

HTH,