topic Re: SDA Trustsec Issues in Network Access Control

SDA Trustsec Issues

mattw — Thu, 10 Nov 2022 17:45:50 GMT

Hello!

I'm setting up a new SDA environment for a customer. They have DNAC 2.3.3.5, ISE 3.1p3, 9500 borders running 17.6.4 and WS-C3650-12X48FD edge switches running 16.12.3s (currently only 2x test edge switches).

I noticed in the ISE RADIUS live logs there are multiple CTS errors for both switches (see attached).

Looks like the switch is trying to communicate with ISE using an unsupported SSL/TLS version which is causing the handshake to fail?

Any idea where I go from here?

I checked Settings > Security settings and these are set to (what I guess are) their defaults: TLS 1.0 and SHA1 ciphers disabled and everything else enabled.

Many thanks in advance!

Matt.

Re: SDA Trustsec Issues

ahollifield — Thu, 10 Nov 2022 17:48:25 GMT

TLS 1.0 is required for TrustSec

Re: SDA Trustsec Issues

mattw — Thu, 10 Nov 2022 23:12:45 GMT

Hi @ahollifield,

Thank you for confirming. I did end up enabling TLS 1.0 which kicked it into life. Seems bonkers in today's day and age??

Re: SDA Trustsec Issues

ahollifield — Fri, 11 Nov 2022 13:14:55 GMT

Agree, it's a really common complaint among my customers.