About MatteoComisso50310

MatteoComisso50310 · 02-05-2025

Hi,we are building a large ISE cluster with 50 PSNs. We'll use it for WI-FI authentication in a corporate environment with managed laptops. Do we really need to put all 50 PSNs FQDNs in the SAN (or a wildcard?) as per documentation.Cisco Identity Ser...

MatteoComisso50310 · 04-24-2024

Hi,we have this fresh install of DNA Center 2.3.5.5-70026. I've been able to create areas using the Intent API but I can't create a building.sitePath = "/dna/intent/api/v1/site" headers = {'content-type': 'application/json'} headers["X-Auth-Token"] =...

MatteoComisso50310 · 06-11-2021

Hi,with AireOS we had both "show logging" and "show traplog" and they were both useful but for different purposes. "show traplog" was really helpful to troubleshoot something "client or AP related" in cases where there was no SNMP trap receiver. I wa...

MatteoComisso50310 · 02-17-2025

Hi Scott,thanks again for your feedback. That is exactly what I've done, and I've not been able to find a single proof that the supplicant can validate the CN/SAN part of the certificate during an EAP authentication unless explicitly configured in th...

MatteoComisso50310 · 02-11-2025

Hi,this is absolutely clear. But "certificate validation" involves different tasks:CA/chain validationvalidity period validationCN/SAN validationThe authentication server is sending the supplicant it's certificate, and the supplicant validates:the ch...

MatteoComisso50310 · 02-10-2025

Hi Scott,very honored to have you involved in this thread "The nodes doing the authentication sends its cert with its fqdn" -> Are you sure? I can't find this mentioned in RFC 2716: PPP EAP TLS Authentication Protocol nor in RFC 3748: Extensible Auth...

MatteoComisso50310 · 02-07-2025

Hi,that is clear, but I still don't understand the authentication. Let's loog at this from the client perspective.I'm a client, I'm connecting a Wi-Fi network, and I'm getting presented with a certificate. I can validate many parts of it, like the CA...

MatteoComisso50310 · 02-07-2025

Hi,thanks for your reply. I know I "can" configure a wildcard FQDN in the SAN, but I'm trying to understand why. I mean: we are planning on using ISE for EAP authentication (EAP-TLS, PEAP, EAPoL) and I can't really understand why those client should ...

Member Since	‎01-11-2021 02:39 AM
Date Last Visited	‎02-12-2025 12:31 AM
Posts	12
Total Helpful Votes Received	2

User Statistics

User Activity

EAP certificate validation with multiple ISE nodes?

Unable to create a building in DNA 2.3.5.5-70026

"show traplog" for Cisco 9800 / IOS XE

Re: EAP certificate validation with multiple ISE nodes?

Re: EAP certificate validation with multiple ISE nodes?

Re: EAP certificate validation with multiple ISE nodes?

Re: EAP certificate validation with multiple ISE nodes?

Re: EAP certificate validation with multiple ISE nodes?