ACS 5.0 - WLC failed to authenticate

[yong khang NG]

Hi Forumers'

My scenario is

1. using microsoft AD running on window 2008, act as AD server, to perform user identity authentication

2. i successfully let the ACS 5.0 appliance bind and join the domain created at the AD server.

3. i also configure on WLC 2100 series with the right on pre-shared key, IP of the RADIUS server (which is my ACS appliance IP)

Problem statement:

1. try access to the network, ACS log showing error log of "Unknow CA, failed to authentication". ( i know i'm missing to place certificate for the EAP somehow...)

Question:

1. to solve this, can i generate ACS self-signed certificate, then let the WLC import the created self-signed certificate from the ACS?

( so EAPoW challenge can happen as ACS and WLC are mutual trusted, what i think ACS just use the AD's user database, so in this cse ACS is the authentication server, and WLC is the authenticator, and my AP / user is the supplicant.., am i rite??)

can i do like this? appreciate any feedback and reply !

2. if my thinking is wrong, can please suggest me a solution  (my requirement is no using any third party trusted agent certificate)

thanks

Noel

[Federico Ziliotto · Accepted solution]

Hi Noel,

If I may update your list, the components should be the following:

- ACS = authentication server

- WLC = authenticator

- wireless client = client

Certificates for EAP authentication are used between the wireless client and ACS (the devices performing EAP authentication): the WLC won't check any certificate from ACS.

You can definitely create a self-signed certificate on ACS to have PEAP working for example.

On the client, you'd then need either not to validate any server certificate, or to import the ACS self-signed certificate as a root CA certificate to trust the ACS self-signed certificate itself when sent by ACS during the PEAP TLS tunnel setup.

As a last note, in order to have WLC working with ACS 5.0, please be sure to be on patch
5.0.0.21.6 or later

http://www.cisco.com/cgi-bin/tablebuild.pl/acs5_patches

in order to avoid the known bug CSCsy17858

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsy17858

Regards,

Fede

--

If  this helps you and/or answers your question please mark the question as  "answered" and/or rate it, so other users can easily find it.

[yong khang NG]

Hi Fede,

thanks for the reply. I need more accurate information indeed..

statement:
1. currently platofrm is using ADE 1010 running on ACS express 5.0.1.1 (yes, update it cause need to support on window 2008 server R2 AD feature)
2. i found out ACS express only able to create self-signed certificate OR install certificate...

option A:
so what you trying to say is after create the self-signed certificate, then manually copy the certificate and install on the client's OS? (am i rite)

option B:
Is there any other way round i can let the ACS express generate CSR? so i can use this CSR and let the CA server signed and installed again on ACS express?  (i have the CA server with me..)

option C:
to back your statement "you'd then need either not to validate any server certificate, or to import the ACS self-signed certificate as a root CA certificate to trust the ACS self-signed certificate.."
, is it i should adviec to do this action as showing on this doc? http://www.utoledo.edu/it/NS/pdfs/Vista%20Wireless%20(PEAP).pdf

Out-of-Topic :

for the attachment snapshoot, how i can create private key file? this part is confusing

(what i recall on ACS v4.2 generate self-signed certificate is where subject name is CN=, then create the .cer and .pvk along with the private key password on it.)

thank you Fede,

N

[Federico Ziliotto · Accepted solution]

Hi Noel,

Please see my answers inline:

option A:

so what you trying to say is after create the self-signed certificate, then manually copy the certificate and install on the client's OS? (am i rite)

[A] Correct, if you want your clients to trust the ACS self-signed certificate.

option B:

Is there any other way round i can let the ACS express generate CSR? so i can use this CSR and let the CA server signed and installed again on ACS express?  (i have the CA server with me..)

[A] ACS Express has no way toi generate a CSR, so you could proceed with the following (on a Microsoft CA for example):

1. Request the Cert (Generate the CSR) via a browser.

On a PC with web browser, connect to Cert Server to request a cert for ACS Express (replace the CAServer with the specific host running the Cert Server)

   * Do it this way so that you can export the cert

   * IE to URL http://CAServer/CertSrv

   * Login with admin account on AD Domain

   * Check Request a certificate

   * Select Advanced Request

   * Select Submit a certificate Request to this CA

   * Select Web Server template

   * In Name (of the cert), give something unique to your ACS

   * In CSP, default of MS Base Crypto Provider 1.0 is fine

   * Key Usage could leave as Both or "Exchange"

   * Key Size should be 1024

   * Check "Create new key"

   * Check "Set the container name" and put in something unique to your ACS Express

   * Leave uncheck "Enable strong private key protection"

   * Check "Mark keys as exportable" '''Leave Export keys to file uncheck'''

   * Check "Use local machine store"

   * Submit the request.

2. Copying the Cert from Windows Cert Server (after the Cert is available)

   * Use MMC to find the cert and Export it.

   * If you cannot find it in MMC the cert can always be located on the CA, under "Issued Certificates", on Details tab, click "Copy to File" to export the cert.

   * Select to export the private key (since ACS will ask for the private key file)

   * Use OpenSSL to convert .pfx/.pvk to .pem

   * Win32 OpenSSL can be download from http://gnuwin32.sourceforge.net/packages/openssl.htm

   * openssl pkcs12 -in c:\privateKeyFileName.pfx -out c:\privateKeyFileName.pem -nodes

   * The cert files are now ready for upload to ACS Express

3. On ACS Express: Install/Upload Cert via the browser

   * Connect to ACS Express via a browser

   * Install certificate with "Install ACS Certificate",

   * Give the CA name for the cert to install (instead of cer file)

   * You can directly use the .pem file generated above for keyfile, ACS Express will know how to parse the private key and ignore the other parts

   * Point ACS to the CA in "ACS CA Setup" and provide the name

   * Update Trust List

option C:

to back your statement "you'd then need either not to validate any server certificate, or to import the ACS self-signed certificate as a root CA certificate to trust the ACS self-signed certificate.."

, is it i should adviec to do this action as showing on this doc? http://www.utoledo.edu/it/NS/pdfs/Vista%20Wireless%20(PEAP).pdf

[A] Yes, to avoid validating the server certificate, on page 6 of this PDF you should not check the option "validate server certificate".

Regards,

Fede

--

If  this helps you and/or answers your question please mark the question as  "answered" and/or rate it, so other users can easily find it.

[yong khang NG]

Sweet fede,

let me try out , definitely will rate after this.

million thanks

N

[Federico Ziliotto]

Sure Noel, let me know how that goes.

Regards,

Fede

--

If  this helps you and/or answers your question please mark the question as  "answered" and/or rate it, so other users can easily find it.

[yong khang NG]

Hi Fede, greetings !

ok, carry out the test on my virtual environment, some update of my action

For your action :-

1. Request the Cert (Generate the CSR) via a browser and  2. Copying the Cert from Windows Cert Server (after the Cert is available)

- i force to use window 2003 template (i duplicate web server template), where only the window 2003 template have the CSP to support MS Base Crypto Provider 1.0

- i able to create, submit request, install certificate. then at the CA MMC able to view at issued certificate.

- able to export the .cer file (from certificate authority / issued certificate and .pfk (from certificate / personal)

- able to convert .pfk file to .pem using openSSL

MY question ONE:

in the way of simulating it's not all can fully comply on your statement mentioned, example like    * Check "Mark keys as exportable" '''Leave Export keys to file uncheck''', i couldnt spot option for ''Leave Export keys to file uncheck''' ...is it making big impact of it?

MY question TWO:

for your action 3. On ACS Express: Install/Upload Cert via the browser, can you kindly tell me what i should do on these 2 statement

   * Point ACS to the CA in "ACS CA Setup" and provide the name

   * Update Trust List

looking on doc it's very limited info for these 2.

thanks fede

N

[Federico Ziliotto]

Hi Noel,

Glad that the main steps worked out. Regarding your questions:

1. Microsoft CA options may vary depending on the CA configuration.

You should be able to test the obtained certificate and private key file even if not all the options matched with my steps.

2. Apologies if I was not too clear on that portion.

After installing the ACS server certificate obtained from the CA, we should also install the corresponding root CA certificate by adding it to the trust list.

All the steps are described also through the following link:

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_express/5.0.1/user/guide/servadm.html#wp1087019

Regards,

Fede

--

If  this helps you and/or answers your question please mark the question as  "answered" and/or rate it, so other users can easily find it.

[yong khang NG]

hi fede,

want to say thank you and your solution is working !!!

u deserve the 5 star, ha

thanks

Noel

[Federico Ziliotto]

Thank you Noel, really glad we could clarify all your questions.

Feel free to ping us back in case any further help would be needed in the future with this setup.

Regards,

Fede

--

If  this helps you and/or answers your question please mark the question as  "answered" and/or rate it, so other users can easily find it.