topic Re: Trust Store error in ISE Intune Integration even after having ITL cert in Network Access Control

Trust Store error in ISE Intune Integration even after having ITL cert

pcno — Thu, 23 Jul 2020 15:57:54 GMT

Hi all,

We run a distributed deployment we have 2 X PAN 2 X PSN 2 X MNT.
I am trying to add MDM integration of Intune to ISE, Following are the steps done for it.

Portal.azure.com, bail more, ITL 1-5 cert are kept inside the ISE trust store. Ise app registration in done in Intune and ISE PAN certificate is uploaded in there and the base 64 value of PAN has been added in Manifest,API permission are given as per document.

But I am getting this trust store error as in attachment. Please tell me what I am missing here?
Do I need to upload all ITL & Portal certificate in each PSN node trust store?
Do I need to upload the PSN node certificate in Azure Manifest?

According to document, only PAN cert is needed to upload in Azure app registration. and PAN primary nod only requires Trust store cert of ITL.

Please help me on this, Refer to attachment.

Re: Trust Store error in ISE Intune Integration even after having ITL cert

pcno — Sun, 02 Aug 2020 10:48:00 GMT

First time seeing a post with 0 replies from the community!!

Re: Trust Store error in ISE Intune Integration even after having ITL cert

poongarg — Sun, 02 Aug 2020 11:43:57 GMT

This occurs when ISE is trying to access the Token Issuing URL and it is returning a certificate that the ISE is not trusting. Make sure the full CA chain is in ISE truststore. If the issue still persists after confirming that, perform packet captures and test connectivity to see what is being sent.

Re: Trust Store error in ISE Intune Integration even after having ITL cert

poongarg — Sun, 02 Aug 2020 12:07:46 GMT

Also refer Step by Step integration guide to verify your config:
https://community.cisco.com/t5/security-documents/how-to-integrate-microsoft-intune-with-ise-2-1-presentation/ta-p/3619502

Re: Trust Store error in ISE Intune Integration even after having ITL cert

mchsmn — Tue, 04 Aug 2020 12:36:16 GMT

Hi,

I'm having the same problem here. Followed those:
https://community.cisco.com/t5/network-access-control/ise-intune-integration-question/m-p/4079471
https://community.cisco.com/t5/network-access-control/trust-store-error-in-ise-intune-integration-even-after-having/td-p/4124332

I'm currently trying to capture traffic to see if there's any clue but so far, we had no success.

Did you get any luck finding a solution?

Kr,

Re: Trust Store error in ISE Intune Integration even after having ITL cert

mchsmn — Tue, 04 Aug 2020 12:47:38 GMT

Thanks but this is really outdated 😉

Re: Trust Store error in ISE Intune Integration even after having ITL cert

pcno — Tue, 04 Aug 2020 15:36:58 GMT

Poongarg , All documents are very old even the setup azure has been changed and no longer the same menu options.
The thing is I was able to do MDM Check via ISE till July half then suddenly I started getting the Trust store error!!

I wonder did any cert got changed recently and that is creating a trust store error.

Re: Trust Store error in ISE Intune Integration even after having ITL cert

poongarg — Wed, 05 Aug 2020 02:35:02 GMT

The Portal.azure.com have below certificates in the certificate chain:
1. Baltimore CyberTrust Root
2. Microsoft IT TLS CA 2
3. Portal.azure.com

We need to import the Baltimore CyberTrust Root certificate in the ISE Trusted Certificates Store as well.
If it is also imported then packet capture on PAN node is the next step for troubleshooting.

Re: Trust Store error in ISE Intune Integration even after having ITL cert

Jatin Katyal — Wed, 05 Aug 2020 05:04:48 GMT

What Poonam recommended make sense. If all the required certificates are already there, then TCPdump would help us to understand ISE connections with the destination URL. To avoid any issue, export the cert's from PCAP and import in ISE trusted cert store.

Re: Trust Store error in ISE Intune Integration even after having ITL cert

mchsmn — Wed, 05 Aug 2020 07:24:44 GMT

This is true but upon inspection, we saw this url called: https://fef.msub05.manage.microsoft.com/

We added his certificate even tough it's the same trust chain (msub05.jpg).

Also, we did a capture and got a "Fatal, certificate unknown" (pcap.jpg). After adding the whole new chain in the trust store, it finally worked (stamp2.login.jpg).

Hope this help!

Take care,

Sim

Re: Trust Store error in ISE Intune Integration even after having ITL cert

pcno — Thu, 06 Aug 2020 14:30:02 GMT

mchsmn, Can you please tell me that do you have anything extra than the below cert in your trust store?

ITL 1-5
Portal.azure.com
Bailmore

And are you puting in PAN primary trust store or in each PSN node?