ISE - CA-signed certificate and subordinates

[eng.malak]

Hi

i have question about using CA-signed certificate in distributed deployment as i followed the whole steps in " trustsec how to guide" between ISE nodes and CA-Root but what i don't understand how the subordinates come to the scene , are there any certificates that i should get or put between the subordinates and the ISE nodes ?

[Jatin Katyal · Accepted solution]

I need to understand what is the purpose of using certificates here. If you're using certificates for deployment purpose and you need to know what all certs you need.

The Primary Admin Node must trust the Secondary Node Certificates before they can be added to Primary Admin Node. If you are using signed certificates then just the Root CA needs to be uploaded to the Primary Admin  Node. If self-signed certificates are being used then each Secondary certificate needs to be uploaded to the Trusted Root Certification Authorities store on the Primary Admin Node. The primary identity certificate must also be added to the Certificate store of the secondary.

If you'are using certificates for  wireless deployment than and you want end-points to validate the server certificate than I'd say install the root CA and subordinates on the ISE and on the end-points too.

Your subordinate CA would be MySUBCA here in the chain.

MyROOTCA-->Signed -->MySUBCA-->Signed-->MyIdentityCert.

Jatin Katyal


- Do rate helpful posts -

[eng.malak]

Hi Jatin

Thank you for you reply

I already used root certificate for nodes registration and now i am thinking about EAP  and certificate validation so it's just to add subordinate's certificate to all ISE nodes ? and the steps you provided is on the subordinate server itself or the root ?

[Jatin Katyal · Accepted solution]

Yes you need to install the subordinate cert on ISE that is contributing to wireless authentication.

Jatin Katyal


- Do rate helpful posts -

[eng.malak]

Thank you Jatin

Sent from Cisco Technical Support iPhone App

[Jatin Katyal]

Your welcome. Here is a link from user guide that may help you while working on EAP.

http://www.cisco.com/en/US/docs/security/ise/1.1/user_guide/ise_auth_pol.html

Jatin Katyal


- Do rate helpful posts -

[mojuneja]

Subordinate CA comes in picture, when you have PKI wherein certificates  are being issued to the end-points from subordinate. In order to support  Distributed ISE deployment you have to create certificates with SAN.

Please refer following link-

http://www.cisco.com/en/US/docs/solutions/Enterprise/Borderless_Networks/Unified_Access/byoddg.html

[harvisin]

Hello,

I went threough your query and found the link below which would help you in solving your query.

http://www.cisco.com/en/US/docs/security/ise/1.1/user_guide/ise_man_cert.pdf