topic Re: ISE 1.2 CRL in Network Access Control

ISE 1.2 CRL

eric.lessard — Mon, 11 Mar 2019 03:53:38 GMT

Hello,

Quick one this time...

What box is requesting the CRL? the ADM or the PSN?

am right to assum that the port 80 need to be open on the FW from ADM or PSN to the CRL location

Thx

Re: ISE 1.2 CRL

aqjaved — Mon, 23 Sep 2013 16:26:42 GMT

ISE supports two ways of checking the revocation status of a client or server certificate that is issued by a particular CA. The first is to validate the certificate using the Online Certificate Status Protocol (OCSP), which makes a request to an OCSP service maintained by the CA. The second is to validate the certificate against a Certificate Revocation List (CRL) which is downloaded from the CA into ISE. Both of these methods can be enabled, in which case OCSP is used first, and only if a status determination cannot be made then the CRL is used.

Please check the below links which can be helpful in configurations:

Link-1

http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_man_cert.html

ISE 1.2 CRL

eric.lessard — Mon, 23 Sep 2013 16:31:55 GMT

Thx Ageel,

After testing, all the box need to be able to acess the CRL, not only the PSN

second fact is that the HTTPS protocol needs to be binded to the CA root Cert in order to Download the CRL.

If your https is binded to a self sign, the Admin node wont be able to DL it

Thx