topic ISE On-Boarding process in Network Access Control

ISE On-Boarding process

thibaus — Mon, 11 Mar 2019 03:34:28 GMT

I seem to have an issue with the SCEP server when it receives the certificate request from the ISE server and I can't seem to identify why this is happening. Here are the error messages I get on the CA:

Active Directory Certificate Services denied request 75 because The certificate has invalid policy. 0x800b0113 (-2146762477). The request was for CN=a@b.com. Additional information: Error Constructing or Publishing Certificate Invalid Issuance Policies: 2.5.29.32.0

The Network Device Enrollment Service cannot submit the certificate request (The certificate has invalid policy.). 0x80004005

Any ideas?

Thanks

ISE On-Boarding process

Marcin Latosiewicz — Sat, 22 Jun 2013 10:52:24 GMT

Have a look at document published by Todd

http://www.cisco.com/en/US/products/ps11640/products_tech_note09186a0080bff108.shtml

It outlines configuration needed on SCEP CA to make it work with BYOD.

ISE On-Boarding process

manjeets — Thu, 22 Aug 2013 15:12:13 GMT

Kindly review the below link :

http://www.cisco.com/en/US/solutions/collateral/ns340/ns414/ns742/ns744/docs/howto_61_byod_provisioning.pdf

Re: ISE On-Boarding process

Ravi Singh — Mon, 26 Aug 2013 03:18:54 GMT

Please go through the attached doc. It will help you in configuring BYOD with ISE.

Re: ISE On-Boarding process

Venkatesh Attuluri — Sun, 01 Sep 2013 09:39:00 GMT

Review this DOC for Configuring On-Boarding Using Identity Services Engine ISE

Re: ISE On-Boarding process

Gaj Anna — Tue, 03 Sep 2013 17:38:13 GMT

Hi thibaus,

I was having the same issue. What CA hirerarchy you are having? Did you manage to find the solution?

This error may be because the byod template is configured with the "all insurance policy" (OID = 2.5.29.32.0) and the CA server is unable to publish the certs using this template due to its policy restrictions. This should be workable once we enable all insurancy policy in the CA server. Looking at how to do this in the CA.

Thx