media conditions like 'NAS Port type = Ethernet' are all you have to work with). The conditions for filtering the connection request are minimal as the device has yet to authenticate and does not have an IP address (i.e. The connection request is proxied to the NPS server via the switch IP. any Cisco phone) will authenticate successfully using that account in NPS. Any device with a certificate issued by that CA (i.e. We will use this mapping to convert the Cisco phone device name to a single account in AD configured with the Cisco Root CA certificate. The CRP can also perform attribute manipulation to allow mapping of device/user names to alternate AD account names if necessary. Is used to determine if the device is allowed to make an authentication request. Unfortunately you can't use the issuing CA to determine if the device is a phone or a workstation, so the tricky part is getting each device type to connect to the proper VLAN after a successful auth. Certificates issued by any other CA's (or self-signed certs) will fail authentication. The NPS server in the pilot is configured with our internal issuing CA's (which issue the workstation certs) and the Cisco Manufacturing CA's (which issue the phone certs).

Cisco LCS certs will not work as they do not contain the CDP and AIA extensions, which are required by NPS (see For the phones we are using the built-in Cisco Manufacturer Installed Certificates (MICs). For the workstations we are using domain CA issued computer certificates.

Both of these policies are explained in greater detail below.Ī certificate is used to perform device authentication. An NPS server can have multiple policies of each type but any lower order policies will be ignored once a condition matches on any policy.

Microsoft Network Policy Server (NPS) uses two types of policies to implement 802.1x authentication, Connection Request Policies (CRP) and Network Policies (NP).

Cisco ip phone ip address menu