topic Re: Cisco ISE 3.2.0.542 External Identity Store Cert Auth via Proxy in Network Access Control

Cisco ISE 3.2.0.542 External Identity Store Cert Auth via Proxy

KatoNakatomi — Wed, 17 Apr 2024 12:55:05 GMT

We have implemented 802.1x with machine certificate authentication.

The certificate validation is via OCSP and the question is does Cisco ISE support connection to OSCP via a Web Proxy? The assumption is that the connection would be using the system proxy settings

However, OCSP is no listed in the notes as one affected by the Proxy Setting

Notes: The following functionalities are impacted by the proxy settings

Partner Mobile Management
Endpoint Profiler Feed Service Update
Endpoint Posture Update
Endpoint Posture Agent Resources Download
CRL (Certificate Revocation List) Download
SMS Message Transmission
Social Login
Rest Auth Service - Azure AD
pxGrid Cloud
TrustSec Integration for Meraki
pxGrid Direct

Re: Cisco ISE 3.2.0.542 External Identity Store Cert Auth via Proxy

Aref Alsouqi — Wed, 17 Apr 2024 13:14:37 GMT

OCSP does not require any download and it is not using the traditional CRL method, so I don't believe there will be any problem with OCSP. The list you provided refers explicitly to the CRL method, not OCSP.

Re: Cisco ISE 3.2.0.542 External Identity Store Cert Auth via Proxy

KatoNakatomi — Wed, 17 Apr 2024 13:38:21 GMT

The challenge is we need the ISE connection to the OCSP server go through a Web Proxy? Is this supported?

Re: Cisco ISE 3.2.0.542 External Identity Store Cert Auth via Proxy

Aref Alsouqi — Wed, 17 Apr 2024 13:45:13 GMT

I can't see why not.

Re: Cisco ISE 3.2.0.542 External Identity Store Cert Auth via Proxy

Arne Bier — Thu, 18 Apr 2024 02:18:30 GMT

@KatoNakatomi - where is the OCSP server located? Normally the web proxy is used to allow ISE to access web resources outside of the company intranet. But if the client certs are issued by the company PKI, then should be no need to go via a proxy. But interesting to note, that there is no mention of OCSP in the ISE web proxy setup. Probably something you could test in the lab (run a tcpdump on the ISE node).

Re: Cisco ISE 3.2.0.542 External Identity Store Cert Auth via Proxy

KatoNakatomi — Thu, 18 Apr 2024 07:04:24 GMT

The OCSP server is an externally hosted outside the organisation, thus requiring the web traffic to traverse a web proxy. We will try the tcpdump on ISE nodes or have the team check the DNS servers if there is any record of the ISE node trying to resolve the external OCSP domain.

Re: Cisco ISE 3.2.0.542 External Identity Store Cert Auth via Proxy

KatoNakatomi — Tue, 23 Apr 2024 07:50:53 GMT

Cisco TAC has advised OCSP connections through a web proxy is not supported by Cisco ISE.

Re: Cisco ISE 3.2.0.542 External Identity Store Cert Auth via Proxy

Aref Alsouqi — Tue, 23 Apr 2024 09:13:28 GMT

Thanks for sharing this info. Did they provide any documentation link that you can share for that?