topic ise certificate validation failed in log in Network Access Control

ise certificate validation failed in log

Abreey — Thu, 15 Oct 2020 06:48:28 GMT

hello cisco community,

I have problem in eap tls and I searching the log in every device to solve the problem.

when I look to wlc, wlc generate log like this :

RADIUS server 10.175.4.71:1812 failed to respond to request (ID 79) for client f8:94:c2:1a:22:a5 / user 'bbb@aaa.com'

and in ISE generate some log, but there is significant log that I think the problem :

34151 WARN System-Management: Certificate Validation Failed, ConfigVersionId=109, AdminName=Unknown, OperationMessageText=Certificate Validation failed for host:ise.aaa.com, AcsInstance=ise.aaa.com,

and my question are :

1. is there any chance the eap-tls not success because certificate in ise (like log said, certificate validation is failed)??

2. I dont see any explanation about that log. would somebody care to explain what I must to do for fixing the log in ISE.

Thank you very much.

Re: ise certificate validation failed in log

Andrii Oliinyk — Thu, 15 Oct 2020 11:15:23 GMT

what do u have in authentication details for this endpoint? can u see 12321 "failed SSL/TLS"?

Re: ise certificate validation failed in log

Abreey — Thu, 15 Oct 2020 11:50:59 GMT

thank you andy for respon,

there is no 12321 "failed SSL/TLS" in ise log.

like picture below, only code 5440 endpoint abandoned EAP session and started new.

I did tcpdump in ISE interface and there is no step 7 to 10 (like picture below) at my pcap file.

Re: ise certificate validation failed in log

Aref Alsouqi — Thu, 15 Oct 2020 15:58:13 GMT

How the endpoint's NIC is configured for dot1x?

Re: ise certificate validation failed in log

Abreey — Fri, 16 Oct 2020 01:04:20 GMT

Hi Aref, thank you for reply,

like picture below, I configured endpoint nic using certificate's user. certificate's user deploy using GPO auto enroll and signed using ENT-CA. ENT-CA and ROOT-CA already in trusted certificates at ISE and endpoint.

Re: ise certificate validation failed in log

Greg Gibbs — Fri, 16 Oct 2020 01:14:31 GMT

If the client supplicant is not sending its certificate chain in response to the server (ISE) certificate, it is likely not trusting the ISE EAP cert and terminating the EAP connection.

I would suggest reviewing the following documents and comparing to your environment:

Understand and configure EAP-TLS using WLC and ISE

Configure EAP-TLS Authentication with ISE - Common Issues and Techniques to Troubleshoot

There is also a similar Community post here that might provide some guidance. These certificate issues can be tricky to troubleshoot without experience, so you might need to open a TAC case to investigate further.

Re: ise certificate validation failed in log

Abreey — Tue, 20 Oct 2020 06:53:46 GMT

Thank you Greg for the answer.

I will call TAC soon for investigate the wlc one. because I create lab with same ise and key chain in wired 802.1x environment it works like a charms.

Thank you so much!