topic Re: ISE 2.2 integration error with SMS Gateway Clickatell in Network Access Control

ISE 2.2 integration error with SMS Gateway Clickatell

MICHAEL HORNE — Thu, 01 Mar 2018 18:25:14 GMT

Hi,

I am trying to integrate ISE 2.2 with the SMS gateway from Clickatell. Unfortunately I have not had any success. I found some guides here on the community, but they have not helped. I want to set up a 1-way integration via HTTPS GET.

Pasting the required URL into a web browser works fine, but it is not working from the ISE. The problem does not seem to be a URL problem, but a certificate problem.

When I try and send a notification from the Sponsor portal I get a error.

When I manually try to send a test SMS from the Guest account type page I get a more detailed error:

When I take a look at the traffic on the proxy I can see that the Server is sending its certificate back and I can see the serial number of the CA certificate that signed it.

The serial number of the CA certificate that signed the server certificate matches what is in the Trusted Certificate store of the ISE.

The next thing I see in my packet trace is the ISE reporting a error back to the server "Certificate Unknown"

If anyone has any idea what might be going wrong, it would be appreciated.

Re: ISE 2.2 integration error with SMS Gateway Clickatell

Arne Bier — Thu, 01 Mar 2018 22:31:59 GMT

Just a stab in the dark - if you can inspect the Clickatel server certificate and then make sure that you have ALL the CA certs in the chain (including Root CA and all possible intermediates) installed in ISE under Trusted Certs.

Re: ISE 2.2 integration error with SMS Gateway Clickatell

MICHAEL HORNE — Fri, 02 Mar 2018 08:34:49 GMT

HI,

I have made sure that the CA and Intermediate CA certificates are are trusted certificates. I have confirmed that the serial numbers and thumbprints of the CA certificates sent by the server as part of the Certificate handshake are the same as the ones in the Trusted Certificate store.

Do you of anyway of checking any logs that might help identify more about the issue?

Many thanks,

Re: ISE 2.2 integration error with SMS Gateway Clickatell

Jason Kunst — Fri, 02 Mar 2018 08:42:24 GMT

Seems like this doc might help you out? if not would recommend troubleshooting with the tac. there is specific information there about the certificate and calls

ISE Guest SMS with Twilio and clickatell update 2017

Re: ISE 2.2 integration error with SMS Gateway Clickatell

MICHAEL HORNE — Fri, 02 Mar 2018 08:59:07 GMT

HI,

I have already looked at this document, but it did not help. It seems that this refers to an early API for Clickatell. The document refers to api.clickatell.com and the documentation on Clickatell refers to "Platform.clickatell.com.

I have tried to follow this as closely as possible only changing what is clearly different, but it did not help.

Do you know any debugging or logs that would be helpful for troubleshooting?

Many thanks,

Re: ISE 2.2 integration error with SMS Gateway Clickatell

Arne Bier — Fri, 02 Mar 2018 09:04:42 GMT

I wrote up some stuff with my own SMS Gateway experiences. ISE SMS Gateway - Easy Config for MessageMedia

I was trawling the guest log - maybe that will help? I didn't enable debugs - but that file helped me a bit

Re: ISE 2.2 integration error with SMS Gateway Clickatell

Jason Kunst — Fri, 02 Mar 2018 09:08:15 GMT

Correct we use the API method. I have ISE 2.3 working with this type of account. You might need to speak to them about getting an account using it this way.

Otherwise I would recommend speaking to them on how to work with their newer method, this might need some updated documentation and troubleshooting with a tac case and get clickatell engaged.

Re: ISE 2.2 integration error with SMS Gateway Clickatell

MICHAEL HORNE — Fri, 02 Mar 2018 10:06:16 GMT

Hi,

I looked at your document. Most of the steps I have already done. We have checked the proxy and from a browser and it works fine. Just from the ISE the problem exists. You did help me with log files I can check.

Re: ISE 2.2 integration error with SMS Gateway Clickatell

Jason Kunst — Fri, 02 Mar 2018 10:15:27 GMT

There is a proxy in between as well? Is it possible to remove that?

Re: ISE 2.2 integration error with SMS Gateway Clickatell

MICHAEL HORNE — Fri, 02 Mar 2018 10:17:58 GMT

HI,

There is a proxy, but it is not doing SSL interception. The certificates from the real server are being passed back to the Cisco ISE.

Re: ISE 2.2 integration error with SMS Gateway Clickatell

hslai — Mon, 12 Mar 2018 17:47:33 GMT

It might be CSCvd34602. If not and if no TAC case yet, please engage Cisco TAC to troubleshoot further.

Re: ISE 2.2 integration error with SMS Gateway Clickatell

Jason Kunst — Mon, 12 Mar 2018 23:19:35 GMT

Please let us know so we can add to our braintrust

Re: ISE 2.2 integration error with SMS Gateway Clickatell

MICHAEL HORNE — Tue, 13 Mar 2018 07:39:35 GMT

Hi,

I requested to discuss with Clickatell support, but got no response from them.

I do not have the write service contract to open up the Cisco TAC directly. I am still trying to locate someone within our organisation that can open a case for me.

Re: ISE 2.2 integration error with SMS Gateway Clickatell

MICHAEL HORNE — Tue, 13 Mar 2018 07:50:31 GMT

Hi,

I did try putting explicit text message to make sure the data part was not empty, but this did not help:

Re: ISE 2.2 integration error with SMS Gateway Clickatell

hslai — Wed, 14 Mar 2018 22:15:31 GMT

Please ensure to import clickatell.com SSL certificate to the Trusted Certificates in ISE and trusted it for

[v] Trust for authentication within ISE

That worked for me, after I changed our test Clickatell URL from HTTP to HTTPS. I downloaded the clicktall.com certificate by putting the HTTPS URL in FireFox and export it out from the browser.

HTH

Re: ISE 2.2 integration error with SMS Gateway Clickatell

MICHAEL HORNE — Fri, 16 Mar 2018 12:46:31 GMT

Hi,

The certificates I had in the certificate store were not marked for "Trust for authentication within ISE". Once I changed this the error went away!

MAny thanks,

Michael

Re: ISE 2.2 integration error with SMS Gateway Clickatell

jasoncgross — Fri, 23 Mar 2018 23:15:40 GMT

So, now that you have it working... I'm curious... are you using the older https://api.clickatell.com/rest/message URL, or the newer https://platform.clickatell.com/messages URL? Would you mind sharing a screenshot of your SMS Gateway config?

Re: ISE 2.2 integration error with SMS Gateway Clickatell

hslai — Sat, 24 Mar 2018 01:41:16 GMT

In reply 13., Michael showed it's the newer https://platform...