ISE Certificate Authority Network access requirement

[tlouderm]

When performing Wireless EAP-TLS using machine certs on ISE, if you are not requiring CRL check does the ISE server, WLAN Controller or wireless client need network communication to the Certificate Authority? The CA is an internal CA and not accessible from the ISE server or the wireless client environment.

-Tim

[hslai]

The CA certificates are imported to the trusted certificates store in ISE for this purpose so ISE does not check anything externally for EAP-TLS auth unless CRL or OCSP configured.

[Mohammed al Baqari · Accepted solution]

Hi,

The connectivity to CA is required only to enroll the certificates. Once
enrollment is completed, access to CA won't be needed (except if CRL or
OCSP points to the CA server) because the client will download the entire
certificate chain on enrollment and will perform local validation of
certificate and chain.

If CRL or OCSP is pointing to CA and you disabled revocation validation,
then access to CA won't be required till the next certificate renewal.

Better option is to use SCEP proxy. In this case you don't need to have
access between clients and CA as your proxy server (which can be ISE or
ASA) can perform certificate enrollment on behalf of the client and you
maintain isolation.


***** Remember to rate useful posts.