topic Meraki MDM Integration with ISE in Network Access Control

Meraki MDM Integration with ISE

Derron Carstensen — Sat, 11 Jun 2016 18:02:13 GMT

I'm helping a customer with a Meraki MDM integration with their ISE deployment and have run across an interesting dilemma. I'm sure I must be missing something simple, as this is not complicated and I've done it before. Yet, I seem to be hitting a brick wall this time.

Simple question: Why are my customer's (and my lab) ISE nodes failing to integrate with Meraki EMM. I have followed the HowTo-68-MDM_Meraki.pdf guide and

Installed the *.meraki.com certificate in ISE's trusted certificate store (it is marked for Infrastructure.)
Grabbed the URL and credentials from Meraki's MDM portal
Entered the necessary fields in the New MDM Server form for ISE
Each time I get a failure from ISE: Connection Failed to the MDM server: There is a problem with the server Certificates or ISE trust store.
1. Obviously this is a generic message for bad certificates, failed connectivity, etc.

I've tried pinging the designated Meraki MDM DNS name via CLI and it translates fine. So I know there is connectivity to the portal. I grabbed the Meraki (*.meraki.com) certificate from my browser while navigating the MDM portal. Perhaps that's the incorrect certificate?

Otherwise I'm using the properties:

Name: Meraki
Server Type: Mobile Device Manager
Authentication Type: Basic
Hostname: n151.meraki.com
Instance Name: (blank)
Username/Password: filled in with credentials provided from Meraki

I've tried this same procedure with v1.4, v2.0 and v2.1 in my lab. Same results every time

What did I miss?

Huge thanks in advance for any input/help!

Re: Meraki MDM Integration with ISE

vibobrov — Sun, 12 Jun 2016 00:25:00 GMT

Have you loaded the GoDaddy Root and Sub into trusted store as well?

Re: Meraki MDM Integration with ISE

Derron Carstensen — Sun, 12 Jun 2016 02:02:24 GMT

Ah yes, that's probably it! I've been running around in so many directions I completely forgot about the cert hierarchy. I'll upload the CA cert and try again shortly. I'm betting that's it.

FYI to Cisco, you may want to update the guide to include uploading the root CA. At least just a note for those of us that have a lapse in judgment

I'll update this post shortly.

Re: Meraki MDM Integration with ISE

Derron Carstensen — Sun, 12 Jun 2016 09:16:03 GMT

Sadly it appears that is not the case. I imported both the *.meraki.com certificate and the CA ESET certificate. Still no change

Re: Meraki MDM Integration with ISE

hslai — Sun, 12 Jun 2016 18:27:39 GMT

Try enabling [ Trust for authentication of Cisco Services ] on the Meraki wildcard certificate or any external MDM ones.

Re: Meraki MDM Integration with ISE

Derron Carstensen — Sun, 12 Jun 2016 22:07:20 GMT

Tried that as well. Still no change in behavior. So odd...

Re: Meraki MDM Integration with ISE

vibobrov — Mon, 13 Jun 2016 00:06:50 GMT

That's interesting. What is ESET SSL Filter CA? I'm seeing *.meraki.com certificate issued by GoDaddy. Is there SSL interception taking place between your browser and n151.meraki.com?

Here's the output of an ssl connection to this host with all the certificates printed out.

PS. After typing this i now looked up that ESET Security is some sort of a filtering product that intercepts SSL connections from the local browser.

VIBOBROV-M-91DW:~ vibobrov$ openssl s_client -showcerts -connect n151.meraki.com:443

CONNECTED(00000003)

depth=3 /C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority

verify error:num=19:self signed certificate in certificate chain

verify return:0

---

Certificate chain

0 s:/OU=Domain Control Validated/CN=*.meraki.com

i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2

-----BEGIN CERTIFICATE-----

MIIFHTCCBAWgAwIBAgIHTrQo4CxKTTANBgkqhkiG9w0BAQsFADCBtDELMAkGA1UE

BhMCVVMxEDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxGjAY

BgNVBAoTEUdvRGFkZHkuY29tLCBJbmMuMS0wKwYDVQQLEyRodHRwOi8vY2VydHMu

Z29kYWRkeS5jb20vcmVwb3NpdG9yeS8xMzAxBgNVBAMTKkdvIERhZGR5IFNlY3Vy

ZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgLSBHMjAeFw0xNDA5MjQxODU5MTdaFw0x

NjA5MTYyMDU3MzlaMDoxITAfBgNVBAsTGERvbWFpbiBDb250cm9sIFZhbGlkYXRl

ZDEVMBMGA1UEAwwMKi5tZXJha2kuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A

MIIBCgKCAQEAw4VL/jdrZ485NXonYC6ZH2x7DKZQ+3EhUeOdujRVtMEOaIp6JNzM

x00V2lb//g/ttIHhw3zhufaP8ZoYCH1U39lDrJvHbXwGmjervN0MkwJISJajjh0G

b8usQPxVQvQE/yTmQo02tR9QmpB4lyQUzId02IO/Vn7ttDHgRjGcVF2lbhi6618v

hdybNY3p3wV5rSZwb4ATAltOjXhtvTavibBk9tRjyuKt11YKhQtuYmfKPApYC8ad

Xg0reAC99u0uvPklDoHCUmd+4H0/mAfAi2gTRkcP58G4EFUemQWxVzehGcAMsN9L

qZwgKDL/HNMTKIx/YOoWk3n525o/b5zg/wIDAQABo4IBqzCCAacwDAYDVR0TAQH/

BAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDgYDVR0PAQH/BAQD

AgWgMDYGA1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly9jcmwuZ29kYWRkeS5jb20vZ2Rp

ZzJzMS04Ny5jcmwwUwYDVR0gBEwwSjBIBgtghkgBhv1tAQcXATA5MDcGCCsGAQUF

BwIBFitodHRwOi8vY2VydGlmaWNhdGVzLmdvZGFkZHkuY29tL3JlcG9zaXRvcnkv

MHYGCCsGAQUFBwEBBGowaDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZ29kYWRk

eS5jb20vMEAGCCsGAQUFBzAChjRodHRwOi8vY2VydGlmaWNhdGVzLmdvZGFkZHku

Y29tL3JlcG9zaXRvcnkvZ2RpZzIuY3J0MB8GA1UdIwQYMBaAFEDCvSeOzDSDMKIz

1/tss/C0LIDOMCMGA1UdEQQcMBqCDCoubWVyYWtpLmNvbYIKbWVyYWtpLmNvbTAd

BgNVHQ4EFgQU4xZk6LY92ssETf8UoXtWA6gamaIwDQYJKoZIhvcNAQELBQADggEB

ACKRswmG4tEFZ9lyw0wTyai/If348QKELB6R68SxXIvTZs7UMpx/NLChj8OaTs9k

ubrMVfHdGNL86y3pL7ESHQO5ImPvmoYNRxqya6NkxGZlgeWAKJUJZzzuCrGWL+J5

rwUHZDU/B8sv1/znUYQcgV7toDvHaxrQmgIuq7GkfdL9njH5w8pf2JwDa6T1kpWv

Hix/0oTGGm1/breI4Euq7UdMFCLwvM9BH4qpkeCUv+unA5dVv7BoN80jQqCx1wrd

WY3NrNTidqKIu2nSdl2X7bGpeEC/C1WK1vn+ohJVd9+PxuKodRoFElHudr5EsMDK

Bn8JxwrbGF8sgw8W6ZCi+y4=

-----END CERTIFICATE-----

1 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2

i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./CN=Go Daddy Root Certificate Authority - G2

-----BEGIN CERTIFICATE-----

MIIE0DCCA7igAwIBAgIBBzANBgkqhkiG9w0BAQsFADCBgzELMAkGA1UEBhMCVVMx

EDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxGjAYBgNVBAoT

EUdvRGFkZHkuY29tLCBJbmMuMTEwLwYDVQQDEyhHbyBEYWRkeSBSb290IENlcnRp

ZmljYXRlIEF1dGhvcml0eSAtIEcyMB4XDTExMDUwMzA3MDAwMFoXDTMxMDUwMzA3

MDAwMFowgbQxCzAJBgNVBAYTAlVTMRAwDgYDVQQIEwdBcml6b25hMRMwEQYDVQQH

EwpTY290dHNkYWxlMRowGAYDVQQKExFHb0RhZGR5LmNvbSwgSW5jLjEtMCsGA1UE

CxMkaHR0cDovL2NlcnRzLmdvZGFkZHkuY29tL3JlcG9zaXRvcnkvMTMwMQYDVQQD

EypHbyBEYWRkeSBTZWN1cmUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IC0gRzIwggEi

MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC54MsQ1K92vdSTYuswZLiBCGzD

BNliF44v/z5lz4/OYuY8UhzaFkVLVat4a2ODYpDOD2lsmcgaFItMzEUz6ojcnqOv

K/6AYZ15V8TPLvQ/MDxdR/yaFrzDN5ZBUY4RS1T4KL7QjL7wMDge87Am+GZHY23e

cSZHjzhHU9FGHbTj3ADqRay9vHHZqm8A29vNMDp5T19MR/gd71vCxJ1gO7GyQ5HY

pDNO6rPWJ0+tJYqlxvTV0KaudAVkV4i1RFXULSo6Pvi4vekyCgKUZMQWOlDxSq7n

eTOvDCAHf+jfBDnCaQJsY1L6d8EbyHSHyLmTGFBUNUtpTrw700kuH9zB0lL7AgMB

AAGjggEaMIIBFjAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNV

HQ4EFgQUQMK9J47MNIMwojPX+2yz8LQsgM4wHwYDVR0jBBgwFoAUOpqFBxBnKLbv

9r0FQW4gwZTaD94wNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8v

b2NzcC5nb2RhZGR5LmNvbS8wNQYDVR0fBC4wLDAqoCigJoYkaHR0cDovL2NybC5n

b2RhZGR5LmNvbS9nZHJvb3QtZzIuY3JsMEYGA1UdIAQ/MD0wOwYEVR0gADAzMDEG

CCsGAQUFBwIBFiVodHRwczovL2NlcnRzLmdvZGFkZHkuY29tL3JlcG9zaXRvcnkv

MA0GCSqGSIb3DQEBCwUAA4IBAQAIfmyTEMg4uJapkEv/oV9PBO9sPpyIBslQj6Zz

91cxG7685C/b+LrTW+C05+Z5Yg4MotdqY3MxtfWoSKQ7CC2iXZDXtHwlTxFWMMS2

RJ17LJ3lXubvDGGqv+QqG+6EnriDfcFDzkSnE3ANkR/0yBOtg2DZ2HKocyQetawi

DsoXiWJYRBuriSUBAA/NxBti21G00w9RKpv0vHP8ds42pM3Z2Czqrpv1KrKQ0U11

GIo/ikGQI31bS/6kA1ibRrLDYGCD+H1QQc7CoZDDu+8CL9IVVO5EFdkKrqeKM+2x

LXY2JtwE65/3YR8V3Idv7kaWKK2hJn0KCacuBKONvPi8BDAB

-----END CERTIFICATE-----

2 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./CN=Go Daddy Root Certificate Authority - G2

i:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority

-----BEGIN CERTIFICATE-----

MIIEfTCCA2WgAwIBAgIDG+cVMA0GCSqGSIb3DQEBCwUAMGMxCzAJBgNVBAYTAlVT

MSEwHwYDVQQKExhUaGUgR28gRGFkZHkgR3JvdXAsIEluYy4xMTAvBgNVBAsTKEdv

IERhZGR5IENsYXNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTQwMTAx

MDcwMDAwWhcNMzEwNTMwMDcwMDAwWjCBgzELMAkGA1UEBhMCVVMxEDAOBgNVBAgT

B0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxGjAYBgNVBAoTEUdvRGFkZHku

Y29tLCBJbmMuMTEwLwYDVQQDEyhHbyBEYWRkeSBSb290IENlcnRpZmljYXRlIEF1

dGhvcml0eSAtIEcyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv3Fi

CPH6WTT3G8kYo/eASVjpIoMTpsUgQwE7hPHmhUmfJ+r2hBtOoLTbcJjHMgGxBT4H

Tu70+k8vWTAi56sZVmvigAf88xZ1gDlRe+X5NbZ0TqmNghPktj+pA4P6or6KFWp/

3gvDthkUBcrqw6gElDtGfDIN8wBmIsiNaW02jBEYt9OyHGC0OPoCjM7T3UYH3go+

6118yHz7sCtTpJJiaVElBWEaRIGMLKlDliPfrDqBmg4pxRyp6V0etp6eMAo5zvGI

gPtLXcwy7IViQyU0AlYnAZG0O3AqP26x6JyIAX2f1PnbU21gnb8s51iruF9G/M7E

GwM8CetJMVxpRrPgRwIDAQABo4IBFzCCARMwDwYDVR0TAQH/BAUwAwEB/zAOBgNV

HQ8BAf8EBAMCAQYwHQYDVR0OBBYEFDqahQcQZyi27/a9BUFuIMGU2g/eMB8GA1Ud

IwQYMBaAFNLEsNKR1EwRcbNhyz2h/t2oatTjMDQGCCsGAQUFBwEBBCgwJjAkBggr

BgEFBQcwAYYYaHR0cDovL29jc3AuZ29kYWRkeS5jb20vMDIGA1UdHwQrMCkwJ6Al

oCOGIWh0dHA6Ly9jcmwuZ29kYWRkeS5jb20vZ2Ryb290LmNybDBGBgNVHSAEPzA9

MDsGBFUdIAAwMzAxBggrBgEFBQcCARYlaHR0cHM6Ly9jZXJ0cy5nb2RhZGR5LmNv

bS9yZXBvc2l0b3J5LzANBgkqhkiG9w0BAQsFAAOCAQEAWQtTvZKGEacke+1bMc8d

H2xwxbhuvk679r6XUOEwf7ooXGKUwuN+M/f7QnaF25UcjCJYdQkMiGVnOQoWCcWg

OJekxSOTP7QYpgEGRJHjp2kntFolfzq3Ms3dhP8qOCkzpN1nsoX+oYggHFCJyNwq

9kIDN0zmiN/VryTyscPfzLXs4Jlet0lUIDyUGAzHHFIYSaRt4bNYC8nY7NmuHDKO

KHAN4v6mF56ED71XcLNa6R+ghlO773z/aQvgSMO3kwvIClTErF0UZzdsyqUvMQg3

qm5vjLyb4lddJIGvl5echK1srDdMZvNhkREg5L4wn3qkKQmw4TRfZHcYQFHfjDCm

rw==

-----END CERTIFICATE-----

3 s:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority

i:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority

-----BEGIN CERTIFICATE-----

MIIEADCCAuigAwIBAgIBADANBgkqhkiG9w0BAQUFADBjMQswCQYDVQQGEwJVUzEh

MB8GA1UEChMYVGhlIEdvIERhZGR5IEdyb3VwLCBJbmMuMTEwLwYDVQQLEyhHbyBE

YWRkeSBDbGFzcyAyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA0MDYyOTE3

MDYyMFoXDTM0MDYyOTE3MDYyMFowYzELMAkGA1UEBhMCVVMxITAfBgNVBAoTGFRo

ZSBHbyBEYWRkeSBHcm91cCwgSW5jLjExMC8GA1UECxMoR28gRGFkZHkgQ2xhc3Mg

MiBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTCCASAwDQYJKoZIhvcNAQEBBQADggEN

ADCCAQgCggEBAN6d1+pXGEmhW+vXX0iG6r7d/+TvZxz0ZWizV3GgXne77ZtJ6XCA

PVYYYwhv2vLM0D9/AlQiVBDYsoHUwHU9S3/Hd8M+eKsaA7Ugay9qK7HFiH7Eux6w

wdhFJ2+qN1j3hybX2C32qRe3H3I2TqYXP2WYktsqbl2i/ojgC95/5Y0V4evLOtXi

EqITLdiOr18SPaAIBQi2XKVlOARFmR6jYGB0xUGlcmIbYsUfb18aQr4CUWWoriMY

avx4A6lNf4DD+qta/KFApMoZFv6yyO9ecw3ud72a9nmYvLEHZ6IVDd2gWMZEewo+

YihfukEHU1jPEX44dMX4/7VpkI+EdOqXG68CAQOjgcAwgb0wHQYDVR0OBBYEFNLE

sNKR1EwRcbNhyz2h/t2oatTjMIGNBgNVHSMEgYUwgYKAFNLEsNKR1EwRcbNhyz2h

/t2oatTjoWekZTBjMQswCQYDVQQGEwJVUzEhMB8GA1UEChMYVGhlIEdvIERhZGR5

IEdyb3VwLCBJbmMuMTEwLwYDVQQLEyhHbyBEYWRkeSBDbGFzcyAyIENlcnRpZmlj

YXRpb24gQXV0aG9yaXR5ggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQAD

ggEBADJL87LKPpH8EsahB4yOd6AzBhRckB4Y9wimPQoZ+YeAEW5p5JYXMP80kWNy

OO7MHAGjHZQopDH2esRU1/blMVgDoszOYtuURXO1v0XJJLXVggKtI3lpjbi2Tc7P

TMozI+gciKqdi0FuFskg5YmezTvacPd+mSYgFFQlq25zheabIZ0KbIIOqPjCDPoQ

HmyW74cNxA9hi63ugyuV+I6ShHI56yDqg+2DzZduCLzrTia2cyvk0/ZM/iZx4mER

dEr/VxqHD3VILs9RaRegAhJhldXRQLIQTO7ErBBDpqWeCtWVYpoNz4iCxTIM5Cuf

ReYNnyicsbkqWletNw+vHX/bvZ8=

-----END CERTIFICATE-----

---

Server certificate

subject=/OU=Domain Control Validated/CN=*.meraki.com

issuer=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2

---

No client certificate CA names sent

---

SSL handshake has read 4908 bytes and written 456 bytes

---

New, TLSv1/SSLv3, Cipher is AES256-SHA

Server public key is 2048 bit

Secure Renegotiation IS supported

Compression: NONE

Expansion: NONE

SSL-Session:

Protocol : TLSv1

Cipher : AES256-SHA

Session-ID: 0EB6ECD1AB6E337CEB6208419A0FAD8E9C94523A5514583CE42AF1B02C743917

Session-ID-ctx:

Master-Key: 162FFAD069757EB6C4B453E6CC97AE715D1AC42D5B321B105F1B81EF5CA3C1DF969F636809C44A48CC517F028935E9F2

Key-Arg : None

Start Time: 1465776149

Timeout : 300 (sec)

Verify return code: 0 (ok)

---

Re: Meraki MDM Integration with ISE

Derron Carstensen — Mon, 13 Jun 2016 15:53:04 GMT

Yes, sure enough that's the problem! I tried checking from a couple other computers and sure enough found the GoDaddy certificate. Apparently there was a SSL proxy that gave me ESET's cert instead. Once I was able to obtain the proper GoDaddy cert everything is now working as it should.

Thank you Viktor for your help!

Re: Meraki MDM Integration with ISE

ozeabala — Tue, 07 Mar 2017 12:06:26 GMT

Hi Viktor,

Reg : Meraki MDM Integration with Cisco ISE

I am following this document How To: Meraki EMM / MDM Integration with ISE getting same error which was posted in same thread. I have tried your suggestion but no luck. I have attached the exact error screen shot in this thread. Please have a look and let me know any work-around to resolve this issue.

FYI :

Cisco ISE version : 2.1.0.474

Re: Meraki MDM Integration with ISE

ozeabala — Wed, 08 Mar 2017 14:01:09 GMT

Hi Derron,

Could you please help to resolve this issue.