topic Re: CPP and Admin certificate different but on same interface in Network Access Control

CPP and Admin certificate different but on same interface

gvanbon — Fri, 20 Oct 2017 09:33:37 GMT

Hi,

Configured the following on ISE 2.3:

1 ISE interface for CPP and Admin

CCP portal runs on TCP port 8443 with its own certificate signed by CA1

Admin portal runs on port 443 with its own certificate signed by CA2

When a CCP redirection occurs, the client first get redirected on port 443 (with the wrong certificate) and to port 8443 with the right certificate.

I would have expected that the client would directly go to the 8443 port.

Anybody seen this ?

Thanks

Re: CPP and Admin certificate different but on same interface

hslai — Fri, 20 Oct 2017 14:01:49 GMT

Yes, I've been seeing it during beta. This appears related to CSCve85686.

Re: CPP and Admin certificate different but on same interface

Arne Bier — Sun, 22 Oct 2017 23:32:23 GMT

I have the same in ISE 2.2 - I raised a TAC case for it. They told me it was due to CSCut16630 (ancient bug).

Luckily I have an F5 load balancer that is masking this issue.

Re: CPP and Admin certificate different but on same interface

hslai — Sun, 22 Oct 2017 23:41:18 GMT

We have an enhancement bug -- CSCva84197, but we have not scheduled to address it yet.

Re: CPP and Admin certificate different but on same interface

gvanbon — Mon, 23 Oct 2017 05:04:04 GMT

Thanks all !

Re: CPP and Admin certificate different but on same interface

grabonlee — Tue, 24 Oct 2017 14:19:31 GMT

The ISE installation guide 2.3 states that ISE presents Admin cert for Posture and CPP, then Portal cert for 8443. So I doubt if it’s really a bug. All the installation guides from 1.2 to 2.3 state this.