ISE 2.6 failed TLS 1.1 handshake with Cisco Phone 802.1x

[mhryckowian]

We are using Cisco 7962G and 7942G model IP Phones and attempting to authenticate them to our ISE 2.6 servers using 802.1x LSC certificates.

My test phone successfully installed the LSC cert, CUCM CAPF cert was imported into ISE, phone set for 802.1x, and ISE authentication / authorization rules were defined based on Cisco ISE Deployment for Wired Network Access guides.

It appears that these model phones only support TLS 1.0 / 1.1 so I checked off Allow TLS 1.1 under ISE Security Setting page

But the RADIUS Authentication details still indicate that TLS 1.1 is not allowed.

Any assistance is greatly appreciated.

[Mike.Cifelli · Accepted solution]

My first assumption would be that it tried to use TLS1.0. The error message says it tried to use one or the other. My recommendation would be to enable TLS1.0, disable 1.1, then run the test again. This way you can identify if it throws same error or if the end node is truly using 1.0. Good luck & HTH!

[mhryckowian]

Mike,

Thanks for the reply.  I was figuring that would have to be my next step but I was hoping there was something else I was missing.  Changing this options requires the ISE servers to restart so I will do this after hours tonight and see what happens.

Thanks again for your help.

[mhryckowian · Accepted solution]

By enabling the TLS 1.0 the phone was able to perform a portion of the handshake revealing another issue.  It appears that the current firmware on these model phones are using older/weaker ciphers.  Given the security implication of enabling ISE to accept weaker ciphers, we are going to have to use MAB authentication for our 7962/7965 model Cisco IP Phones.

Thanks,

Mitchell