topic Re: ISE Certificate Days to Expiry log in Network Access Control

ISE Certificate Days to Expiry log

slevesqu — Wed, 14 Nov 2018 15:17:02 GMT

Hi,

Customer is trying to figure out a way to create a report of the MIC certificates in their Cisco IP Phones and their date of expiration to plan for the implementation of LSC.

Since we can use the "Days to Expiry" attribute in an AuthZ policy and it provides the quantity of days to expiry, it means that the expiration date is extracted and logged somewhere I guess. In which log can I find this information?

Thanks

Re: ISE Certificate Days to Expiry log

Surendra — Wed, 14 Nov 2018 15:39:52 GMT

ISE does not store those attributes anywhere and the conditions are run in a Just In Time(JIT) fashion where they are evaluated at the runtime and a decision is taken based on the values returned. They are logged at TRACE level on the logs that reside on the ISE which are written locally. So in short, there is no way you can pull those attributes from ISE.

Re: ISE Certificate Days to Expiry log

slevesqu — Thu, 15 Nov 2018 20:55:45 GMT

100% clear thank you sir!

Re: ISE Certificate Days to Expiry log

Nadav — Fri, 16 Nov 2018 18:57:50 GMT

I imagine ISE calculates the expiry date by deducting the expiration date of the cert from the current date. All X.509 certs have validity attributes.

BTW why wait for the MICs to expire? Why risk having phones not register some day in the future when you can just install your LSCs during a maintenance window?

Re: ISE Certificate Days to Expiry log

slevesqu — Thu, 06 Dec 2018 15:06:49 GMT

Not that easy the CUCM is managed by a 3rd party which makes it challenging to deploy LSCs in the short term

Re: ISE Certificate Days to Expiry log

gnegronida — Mon, 17 Aug 2020 16:36:40 GMT

One alternative in this case, would be to write a duplicate policy for authenticating your phones on top of the existing policy but name this policy something like 'Phone-Auth-expires-less-than-100' and add the expire attribute as something that must be matched. You can then easily report on the devices that match this policy instead of your already existing policy.