Phase 2: EAP-TEAP for BYOD

Scope

  • Personal devices connecting to corporate network

  • Contractor devices

  • Devices that cannot be domain-joined

Why EAP-TEAP for BYOD?

  • Supports certificate enrollment later

  • Password fallback during transition

  • Machine + user auth in single session

  • Better security than pure MSCHAPv2

Implementation

ISE Configuration

  1. Enable EAP-TEAP in Allowed Protocols

  2. Configure inner methods:

    • Primary: EAP-TLS (for devices with certs)

    • Secondary: EAP-MSCHAPv2 (fallback)

  3. Create authorization policies with tiered access

Authorization Tiers

BYOD-With-Cert:     Full network access
BYOD-Password-Only: Limited access (remediation VLAN)

BYOD Onboarding Portal

  1. User connects to BYOD SSID

  2. Redirected to onboarding portal

  3. Self-service certificate enrollment

  4. Device registered in ISE endpoint database

Policy Configuration

Authentication Policy

Rule: BYOD-TEAP
Condition:
  Wireless:SSID EQUALS "BYOD"
  AND Network Access:EapTunnel EQUALS TEAP
Identity: AD + Internal Users

Authorization Policies

Rule: BYOD-Cert-Full
Condition:
  Network Access:EapAuthentication EQUALS EAP-TLS
Result: BYOD_Full_Access

Rule: BYOD-Password-Limited
Condition:
  Network Access:EapAuthentication EQUALS EAP-MSCHAPv2
Result: BYOD_Limited_Access
  - VLAN: Remediation
  - ACL: Permit internet, block internal
  - Redirect: Certificate enrollment portal

User Communication

Email Template

Subject: Network Access Changes - Action Required

Dear [User],

Starting [date], personal devices connecting to the corporate network
will require a security certificate for full access.

To continue with full access:
1. Connect to BYOD network
2. Complete the certificate enrollment portal
3. Reconnect with certificate

Devices without certificates will have limited access.

Questions? Contact help desk.

Monitoring

BYOD Authentication Mix

SELECT AUTHENTICATION_PROTOCOL, COUNT(*) as COUNT
FROM RADIUS_AUTHENTICATIONS
WHERE SSID = 'BYOD'
AND TIMESTAMP_TIMEZONE > SYSDATE - 7
GROUP BY AUTHENTICATION_PROTOCOL

Success Criteria

  • 80%+ BYOD devices using certificates

  • Password-only users declining week over week

  • No increase in help desk tickets