topic Re: ISE Machine Cert Authentication Issue in Network Access Control

ISE Machine Cert Authentication Issue

fatalXerror — Wed, 14 Apr 2021 08:50:21 GMT

Hi Guys,

I have issue right now about EAP-TLS computer authentication, the ISE is rejecting the authentication and based on the ISE logs,

"12514 EAP-TLS failed SSL/TLS handshake because of an unknown CA in theclient certificates chain"

I checked the certificate-chain of ISE and the certificate-chain of the endpoint, all matched but still the ISE is rejecting it and showing that failure reason.

Any idea how to resolve this?

Thank you.

Re: ISE Machine Cert Authentication Issue

Marcelo Morais — Wed, 14 Apr 2021 09:30:01 GMT

Hi @fatalXerror

please try to perform a manual Synchronization between the Nodes (Administration > System > Deployment) ... take a look at: CSCux69800 ISE 2.0 / EAP-TLS: unknown CA in the client certificates chain.

Note: also take a look at an old bug: CSCtq31131 Sometimes need to delete some trust certs for the required certs to work (sometimes the Root and Intermediate CA are not properly imported into ISE and you must delete and re-add).

Hope this helps !!!

Re: ISE Machine Cert Authentication Issue

fatalXerror — Wed, 14 Apr 2021 10:13:56 GMT

Hi, may i know how can I do a manual synchronization? Thanks

Re: ISE Machine Cert Authentication Issue

Marcelo Morais — Wed, 14 Apr 2021 12:34:49 GMT

Hi,

at Administration > System > Deployment > select a PSN > and click Syncup:

Hope this helps !!!