topic Authenticate Cisco IP Phone to ISE using MIC Certificate in Network Access Control

Authenticate Cisco IP Phone to ISE using MIC Certificate

dan.letkeman — Fri, 21 Feb 2020 18:34:07 GMT

Hello,

I am trying to authenticate our IP Phones using the built in MIC certificate. I am unable to find documentation on how to acheve this with ISE. I found an older ACS document, but I find that there are many aspects that are different.

I have installed the CAP-RTP certs from our CUCM servers into the Trusted store in ISE.

I have an authentication policy that allows wired 802.1x and EAP-TLS, and an authorization policy that allows EAP-TLS and a certificate with a subject that starts with CP-. Could the Authentication policy be incorrectly setup?

I get a 12514 error stating that there is an unknown CA in the client cert chain. The documentation states that you need to have the two Cisco CA certs, and they are installed in ISE, however the older ones are disabled. Could this be part of the issue? Is there any harm in enabling them?

Thanks,

Dan.

Re: Authenticate Cisco IP Phone to ISE using MIC Certificate

Francesco Molino — Sat, 16 Sep 2017 01:50:53 GMT

Hi

Can you share the complete config you've done on ise?
You're missing a trusted CA from CUCM. Have you exported all those certificates: Cisco_Root_CA_2048, Cisco_Manufacturing_CA, CAP-RTP-001, and CAP-RTP-002 ?
And imported them into ISE?

Re: Authenticate Cisco IP Phone to ISE using MIC Certificate

dan.letkeman — Sat, 16 Sep 2017 23:38:30 GMT

I had to enable the older Cisco Root certs that were installed on ISE. By default only the two newer Cisco Root certs are enabled.

Re: Authenticate Cisco IP Phone to ISE using MIC Certificate

fpadron — Wed, 28 Mar 2018 14:13:36 GMT

Dan,

Was that all you had to do? Also, can you share the screenshot of the policy you created on ISE? I am getting ready to do a similar deployment.

Thank you,

Francisco Padron.

Re: Authenticate Cisco IP Phone to ISE using MIC Certificate

dan.letkeman — Wed, 28 Mar 2018 15:09:15 GMT

Here you go.

Re: Authenticate Cisco IP Phone to ISE using MIC Certificate

Octavian Szolga — Wed, 28 Mar 2018 19:36:22 GMT

HI,

Your policy looks ok.

Just do a capture on ISE (host SWITCH_IP) and check in wireshark the phone cert. (it will not be that hard to see)

Thanks,

Octavian