Version: 3.1.0.518 Patch 6 and 7
The client can register once on the ISE via EAP-TLS with a certificate - after that problems arise.
If you restart the notebook, it works again once.
At patch 6
Approx. 250 users affected:
The ISE log shows that an EKU that we use for authentication is not passed or recognized when authenticating again.
This is not a problem with the initial authentication.
Only some Windows clients are affected.
At patch 7
Approx. 1300 users affected
The ISE log shows that the ISE cannot read the SAN of the certificate correctly. "33047 User name attribute is missing in client certificate" as an error message from the ISE
This is not a problem with the initial authentication.
All Windows clients are affected.
The certificate-based authentication of our iPhones, on the other hand, works perfectly; we also check for the EKU here.
Both problems occur over both LAN and WLAN authentication.
in other words:-
we are having client authentication issues with Cisco ISE version 3.1.0.518 patch 6 or 7 (both issues).
With the update to version 6, parts of the certificate EKU were no longer displayed - the authentication therefore no longer works.
Since the update to version 7 we get the error 22047 User name attribute is missing in client certificate.
Although the certificate has not changed and all settings match when looking at the client certificate.
The client can initially log on to the LAN/WLAN once after booting, but no longer after that.
can this fix the issue?
https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/release_notes/b_ise_31_RN.html#concept_lvg_kw1_xsb:~:text=AAA%20Servers.-,EAP%2DTLS%20Authentication%20Might%20Fail%20for%20Certificates%20Using%20TPM%20Module,%5B33%5DEnable/Disable/Current_stat...
.
