topic Re: ISE 2.4: Can you configure multiple "CRL Distribution URL"s per trusted certificate? in Network Access Control

ISE 2.4: Can you configure multiple "CRL Distribution URL"s per trusted certificate?

Nadav — Wed, 03 Jul 2019 14:12:36 GMT

Hi everyone,

If I'd like to check more than one FQDN for a CRL prior to authenticating a trusted certificate, is this supported? As far as I can tell the documentation doesn't define this field as a list but as a single URL.

Example: myCDP1.mydomain.com/CRL.crl, myCDP2.mydomain.com/CRL.crl

Thanks!

Re: ISE 2.4: Can you configure multiple "CRL Distribution URL"s per trusted certificate?

hslai — Wed, 03 Jul 2019 19:25:12 GMT

This is not currently support. I got validation error when attempting to squeeze in multiple URIs into a single text field.

Re: ISE 2.4: Can you configure multiple "CRL Distribution URL"s per trusted certificate?

Nadav — Thu, 04 Jul 2019 21:01:26 GMT

Thanks for the quick reply.

That's unfortunate, it can mean a single point of failure for any communication based on that trusted certificate (including dot1x and secure syslog).

Any idea how this can be remediated without a load balancer?

Re: ISE 2.4: Can you configure multiple "CRL Distribution URL"s per trusted certificate?

hslai — Thu, 04 Jul 2019 21:46:46 GMT

I think it possible to do DNS load balancing or AnyConnect, although I have not personally configured either.