Wireless Access

We've got a wireless network of multiple Aruba wireless controllers and access points. At the moment, we're investigating deploying two factor authentication, with the two factors being: Domain Username/Password and a Certificate.

 

Is the only way to do two factor authentication like this with EAP-Chaining?

 

Will EAP-Chaining work on Android and Apple IOS devices? 

 

We would normally be able to use machine authentication for something like this but we are wanting two factor authentication for devices that aren't in AD. 

The controller is EAP agnostic. The answer would depend on what you're using
for your RADIUS server.

We're going to be using Cisco ISE. Aruba has functionality to enable a machine authentication option, I had hoped that it would also have some kind of functionality to check for certs or something. 

If you're using ISE, you could leverage ISE for all policy decisions. You
shouldn't mix controller authentication functions and RADIUS server
authentication functions.