topic Re: NAC certificate error in Network Security

NAC certificate error

blaxucisco — Fri, 21 Feb 2020 12:03:41 GMT

hi all,

we are facing a certificate error problem on the in-band mode NAC. While user tries to communicate with ms outlook via in-band nac after the NAC process, user get the certificate error message from the proxy server, but when user clicks the view certificate option in-band cas certificate will be appear. but sometimes users can use MS outlook without error message.

FQDN of cas server is not bypassing from the proxy server.

please find the attached file for detail.

thank you

Laxman

Re: NAC certificate error

Faisal Sehbai — Wed, 25 Aug 2010 10:46:39 GMT

Laxman,

Not clear on the problem description here. You're saying that users while behind an IB NAC are getting certificate errors when they try to use Outlook?

If so, does that happen when they're authenticated? If it happens before authentication it's quite possible that NAC is hijacking the SSL traffic and trying to redirect it to it's login page.

Can you clarify your setup and the problem you're having a bit more clearly?

Thanks,

Faisal

Re: NAC certificate error

blaxucisco — Sun, 29 Aug 2010 08:49:48 GMT

Hi Faisal,

This is happening when user

I get the following error only when connecting to Exchange while authenticated through NAC

Next, does NAC client create any client-site logs?

Thank you

Laxman

Re: NAC certificate error

Faisal Sehbai — Sun, 29 Aug 2010 16:58:57 GMT

Laxman,

Verify that in the end role you have traffic allowed to the Exchange server. A CAS cert error should only pop up either when it's trying to authenticate or trying to block your traffic.

Client does generate logs which I'd be glad to look at if you post them here. You can get to those by going to Start -> Programs and Cisco Log Packager.

HTH,

Faisal

Re: NAC certificate error

blaxucisco — Mon, 30 Aug 2010 00:22:19 GMT

Hi Faisal,

Thank you for your response.

Could you please tell me what is the cisco log packager and how can I download it?

thank you

Laxman

Re: NAC certificate error

Faisal Sehbai — Mon, 30 Aug 2010 01:46:09 GMT

Laxman,

If using the new version of CCA (4.6 and above) it's installed by default when you install the agent.

If you're using CCA Agents below that version, you'll have to edit the registry and then collect the agent logs. Details on that are here:

http://www.cisco.com/en/US/docs/security/nac/appliance/release_notes/45/45rn.html#wp607061

HTH

Faisal