ISE Certificate Authentication and Contractor Onboarding After an Azure AD Migration
A financial services firm has 25,000 employees and 8,000 contractors. Cisco ISE handles 802.1X for wired and wireless, guest access, and VPN posture. The company is migrating identity from on-prem AD to Azure AD and adding Duo for VPN MFA. Managed Windows devices use EAP-TLS certificates from an internal Microsoft CA; contractors use BYOD onboarding. After the AD migration, managed devices intermittently fail EAP-TLS, contractor BYOD enrollment stalls at certificate provisioning, and VPN users report repeated MFA prompts. ISE node CPU rises to 85% after enabling several profiling probes. The firm wants to keep certificate-based authentication and reduce helpdesk tickets.
1. Diagnose the EAP-TLS failures after the AD migration and describe the checks you would perform.
Read the worked answer
EAP-TLS failures after an AD migration often come from certificate template changes: the SAN or UPN no longer matches the identity ISE expects, the old CA chain is not trusted, auto-enrollment failed, or the certificate authentication profile compares the wrong field. Check ISE's certificate authentication profile, allowed SANs, trusted certificates, and the endpoint's certificate chain. Confirm that the template includes the correct UPN and DNS name and that the domain migration did not break auto-enrollment or CRL/OCSP reachability. If ISE compares a certificate field against AD, update the attribute mapping. Test with a known device and inspect supplicant and ISE logs. Do not fall back to PEAP globally; fix the certificate chain first. Intermittent failures also suggest that some devices still hold old certificates, so identify them by certificate serial or issuing CA.
2. Why does contractor BYOD enrollment stall at certificate provisioning, and how would you redesign the onboarding flow?
Read the worked answer
Contractor BYOD enrollment stalls at certificate provisioning because the SCEP or EST connector, CA template, or BYOD portal certificate profile is misconfigured, or because the contractor identity is not in the identity store or group that owns the profile. Keep contractors in a separate identity store or group and scope the onboarding profile to that group. If Azure AD is authoritative, verify that ISE can query it and that group claims map correctly. Use a dedicated contractor SSID or VLAN and a posture policy that does not require domain membership. For devices that cannot enroll, offer a sponsored guest flow with limited access. Test the full chain: portal authentication, SCEP, CA issuance, profile installation, and 802.1X. Reduce helpdesk load by adding clear error messages and a self-service retry path.
3. Explain the repeated VPN MFA prompts and the high ISE CPU, and recommend changes.
Read the worked answer
Repeated VPN MFA prompts usually mean MFA is enforced twice: the VPN concentrator challenges with Duo while ISE also invokes Duo, or a RADIUS proxy retries and triggers a second challenge. Choose one enforcement point. If ISE is the policy decision point, terminate RADIUS at ISE and let ISE call Duo, or use Duo directly at the VPN and have ISE trust the result. Check timeout and retry settings, and whether a password change or posture recheck causes a second authentication.
For CPU, disable profiling probes that are not used for policy, such as unnecessary NetFlow, DHCP, SNMP, or RADIUS probes. Reduce probe frequency, purge stale endpoints, and move profiling to a dedicated policy node if needed. Make one change at a time and monitor CPU and authentication latency. Do not disable certificate authentication or MFA to reduce load; tune the policy and the probe set.