topic <B>Symptom:</B> in Network Access Control

ISE Single SSID BYOD - Windows Endpoint user experience

rchilukuri — Mon, 11 Mar 2019 04:22:19 GMT

We are implementing wireless BYOD using Cisco ISE 1.2 and WLC 7.4x. We are using PEAP / MS-CHAP v2 for wireless security. We are able to on-board iOS, Adroid, and MAC OS endpoints using single SSID and Native supplicant provisiong seems to work fine with these endpoints. We are having issues with Windows clients. On Windows client, when the user selects the SSID, it is prompting for userid/password, but never gets a pop-up for server certificate. We are using a third party public wildcard certificate on ISE for HTTP/EAP authentication. On ISE, we are getting: 12511 Unexpectedly received TLS alert message; treating as a rejection by the client.

ISE Single SSID BYOD - Windows Endpoint user experience

Aastha Chaudhary — Mon, 10 Feb 2014 17:41:31 GMT

It seems you are running into an Internal bug where PEAP/TLS authentication fails on Windows when using a Wildcard Certificate. Other devices such as Android, MAC OS etc work fine. During testing, this was found to be an issue with blank CN. Does your certificate have a blank CN field as well?

Unfortunately the bug is not resolved yet, and still being worked on.

Thanks,

Aastha

*Please rate helpful posts*

ISE Single SSID BYOD - Windows Endpoint user experience

blenka — Tue, 11 Feb 2014 19:08:27 GMT

12511

EAP

Unexpectedly received TLS alert message; treating as a rejection by the client

While trying to negotiate a TLS handshake with the client, ISE received an unexpected TLS alert message. This might be due to the supplicant not trusting the ISE server certificate for some reason. ISE treated the unexpected message as a sign that the client rejected the tunnel establishment.

Warn

Symptom:

Saurav Lodh — Fri, 01 Aug 2014 01:27:51 GMT

<B>Symptom:</B>

Some endpoint devices (Windows OS)  have issues with wildcard cert when CN contains * (start) as wildcard

the PEAP authentication fails due to "12511 Unexpectedly received TLS alert message; treating as a rejection by the client"



<B>Conditions:</B>
when the  wildcard cert  contains  * (start) as wildcard in CN 

<B>Workaround:</B>

create wildcard with * (start)
e.g. CN= aaa.cisco.com