Dot1x User Authentication with Certificates

[Dkiptoo]

Hello, we have ISE as AAA server and is configured to authenticate network users using user certificates issued by our local CA server.  Successfully authenticated users, which are AD users are placed on Corps  VLAN otherwise guest vlan. I have an issue lately, the certificates for some of the users expired and now are on the guest vlan. The problem is I cannot renew the certificates directly from the client as they cannot reach the CA, due to being on the guest. I get the error that it cannot reach the server. How do I go about such an issue. How do I renew the certificates for other users. Thank you

[MHM Cisco World]

Hi @Dkiptoo 

There are two steps if yoh want use ISE for renew expired cert

1- allow expired in allow protocol <<- this done 

2- add authz policy with condition 

Attribute: Certificate Status

Condition: Equals

Value: Expired

Step 2 you missing it that so the policy use guest authz policy 

Add it and everything will work.

MHM

[Dkiptoo]

I have tried the first option but still no cert renewal requests or new renewals are reaching the CA. 

[MHM Cisco World]

This not option it steps

You need two steps 

[Rob Ingram]

---

@Dkiptoo wrote:

I have tried the first option but still no cert renewal requests or new renewals are reaching the CA. 

---

@Dkiptoo if you modified the ISE to allow expired certificates, are the clients with expired certificates authenticated now and can they access the network?

If they have network access then the latest problem doesn't seem like an ISE problem. Has the client received the GPO with the correct settings to renew the certificates? Refresh the GPO on the client computers if needs be. Have you tried manually renewing certificates to see if that works, if that works that would imply a problem with the GPO settings.

[Dkiptoo]

I did modify ISE to allow expired certs to be renewed. The clients are authenticated but because the don't have valid certs, they are place the guest VLAN. I have counter checked the GPO policy from the AD and seems everything is fine. Currently the clients on the guest can't access the CA, as it is on the Corp network, different VLan therefore trying to request Cert Manually fails. 

[Rob Ingram]

@Dkiptoo It seems like you haven't allowed the devices with expired certificates to be authenticated and placed in the correct VLAN, hence why they still cannot communicate with the CA to authenticate.

What have you actually configured? Provide screenshots of your rules and the ISE logs of these devices.

The alternative option is to MAB those devices, provide temporary access to renew the certificates, once they have the certificate they would authenticate using certificates again.

[MHM Cisco World]

Share live log detail 

Include steps 

Include authc 

Include authz 

Let us check 

MHM