EAP-TEAP Policy Design

Design Goals

  • Reward certificate-based auth with more access

  • Allow password fallback with limited access

  • Support transition period during migration

Policy Structure

Policy Set: Wired-TEAP
├── Authentication Policy
│   └── TEAP-Auth: Identity = AD + Certificate Lookup
├── Authorization Policy
│   ├── TEAP-Machine-Cert: Full Access
│   ├── TEAP-User-Cert: Full Access
│   ├── TEAP-Chained: Full Access
│   ├── TEAP-Password-Only: Limited Access
│   └── Default: Deny

Conditions

Certificate-Based

# Machine authenticated with cert
Network Access:EapTunnel EQUALS TEAP
AND Network Access:EapAuthentication EQUALS EAP-TLS
AND Network Access:EapChainingResult EQUALS Machine Succeeded

Chained Authentication

# Both machine and user with certs
Network Access:EapChainingResult EQUALS User and Machine Succeeded

Password Fallback

# User fell back to password
Network Access:EapAuthentication EQUALS EAP-MSCHAPv2

Authorization Profiles

Full Access

Name: TEAP_Full_Access
Access Type: ACCESS_ACCEPT
DACL: (none - full network access)
VLAN: Production

Limited Access

Name: TEAP_Limited_Access
Access Type: ACCESS_ACCEPT
DACL: PERMIT-LIMITED
VLAN: Restricted

Transition Strategy

During MSCHAPv2 migration:

  1. Week 1-4: Password fallback = Same access as cert

  2. Week 5-8: Password fallback = Limited access + warning

  3. Week 9+: Password fallback = Deny

See MSCHAPv2 Migration for phased approach.