topic Re: ISE and CRL Verification in Network Access Control

ISE and CRL Verification

M.G. — Tue, 22 Feb 2022 10:44:58 GMT

Hi team,

How can I verify that the CRL is actually downloaded in ISE, and it's being used.

I don't have the option to test with an endpoint that it's computer certificate is revoked.

Thank you,

M.G.

Re: ISE and CRL Verification

Mike.Cifelli — Tue, 22 Feb 2022 13:57:08 GMT

How can I verify that the CRL is actually downloaded in ISE, and it's being used.

-A couple of quick options to verify:

--The radius detailed live log should contain crl information in Steps data for an authenticated session. Same goes for OCSP if using that.

--Run a tcpdump from one of the PSNs, download pcap, search for http.

Re: ISE and CRL Verification

thomas — Mon, 07 Mar 2022 04:32:09 GMT

Do you have a syslog server that you export logs to?

You should be seeing log messages about whether or not the CRL was added or failed:

Re: ISE and CRL Verification

M.G. — Mon, 07 Mar 2022 04:49:22 GMT

Thank you Mike and Thomas,

I noticed that if CRL download is not successful you will get an alert in the Dashboard. In addition in the RADIUS live logs (depending on your config for the specific trusted certificate) , after "ISE will continue to CRL verification..." you will see "CRL verification Bypassed" in case CRL download was not successful.

The Syslog server messages clearly showed the addition of the CRL.

Thanks again for your assistance.

M.G.