topic LDAP SSL error in Network Access Control https://community.cisco.com/t5/network-access-control/ldap-ssl-error/m-p/3482840#M524323 <HTML><HEAD></HEAD><BODY><P>HI,</P><P>I configured ISEv2.0 with External Database LDAP feature.</P><P></P><P>Test by LDAP bind&nbsp; from Primary Master ISE it'ok but the other ISE in grid tells ERROR.</P><P></P><P>Anyone can tell me why?</P><P></P><P><SPAN lang="EN-US" style="font-size: 11.0pt; font-family: 'Calibri','sans-serif';">139713221547776:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:637</SPAN>&nbsp; </P></BODY></HTML> Wed, 14 Jun 2017 07:26:25 GMT Fabio Flori 2017-06-14T07:26:25Z LDAP SSL error https://community.cisco.com/t5/network-access-control/ldap-ssl-error/m-p/3482840#M524323 <HTML><HEAD></HEAD><BODY><P>HI,</P><P>I configured ISEv2.0 with External Database LDAP feature.</P><P></P><P>Test by LDAP bind&nbsp; from Primary Master ISE it'ok but the other ISE in grid tells ERROR.</P><P></P><P>Anyone can tell me why?</P><P></P><P><SPAN lang="EN-US" style="font-size: 11.0pt; font-family: 'Calibri','sans-serif';">139713221547776:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:637</SPAN>&nbsp; </P></BODY></HTML> Wed, 14 Jun 2017 07:26:25 GMT https://community.cisco.com/t5/network-access-control/ldap-ssl-error/m-p/3482840#M524323 Fabio Flori 2017-06-14T07:26:25Z Re: LDAP SSL error https://community.cisco.com/t5/network-access-control/ldap-ssl-error/m-p/3482841#M524325 <HTML><HEAD></HEAD><BODY><P>I would suggest to do a TCPDUMP or similar wired capture between ISE primary node and the LDAP server in question. Then, review the pcap file in <A href="http://SSL - The Wireshark Wiki/">WireShark</A> or similar tool to examine the SSL packet exchange details.</P></BODY></HTML> Wed, 14 Jun 2017 15:51:23 GMT https://community.cisco.com/t5/network-access-control/ldap-ssl-error/m-p/3482841#M524325 hslai 2017-06-14T15:51:23Z Re: LDAP SSL error https://community.cisco.com/t5/network-access-control/ldap-ssl-error/m-p/3482842#M524327 <HTML><HEAD></HEAD><BODY><P>Hi,</P><P>I find the solution :d</P><P>In External Identity Source when I configured LDAP external server via LDAPS&nbsp; I had select the "Issuer CA of ISE Certificates" and I had the error, with only the "LDAP Server Root CA" the problem isn't.&nbsp; </P><P><IMG class="image-1 jive-image" src="https://community.cisco.com/legacyfs/online/fusion/108333_pastedImage_0.png" style="max-height: 900px; max-width: 1200px;" /></P><P></P><P>Thanks for your help!!</P></BODY></HTML> Thu, 15 Jun 2017 06:26:11 GMT https://community.cisco.com/t5/network-access-control/ldap-ssl-error/m-p/3482842#M524327 Fabio Flori 2017-06-15T06:26:11Z