Heads Up :
The post you are writing will appear in a public forum. Please ensure all content is appropriate for public consumption. Review the employee guidelines for the community here.
Hi,we are building a large ISE cluster with 50 PSNs. We'll use it for WI-FI authentication in a corporate environment with managed laptops. Do we really need to put all 50 PSNs FQDNs in the SAN (or a wildcard?) as per documentation.Cisco Identity Ser...
Hi,we have this fresh install of DNA Center 2.3.5.5-70026. I've been able to create areas using the Intent API but I can't create a building.sitePath = "/dna/intent/api/v1/site"
headers = {'content-type': 'application/json'}
headers["X-Auth-Token"] =...
Hi,with AireOS we had both "show logging" and "show traplog" and they were both useful but for different purposes. "show traplog" was really helpful to troubleshoot something "client or AP related" in cases where there was no SNMP trap receiver. I wa...
Hi Scott,thanks again for your feedback. That is exactly what I've done, and I've not been able to find a single proof that the supplicant can validate the CN/SAN part of the certificate during an EAP authentication unless explicitly configured in th...
Hi,this is absolutely clear. But "certificate validation" involves different tasks:CA/chain validationvalidity period validationCN/SAN validationThe authentication server is sending the supplicant it's certificate, and the supplicant validates:the ch...
Hi Scott,very honored to have you involved in this thread "The nodes doing the authentication sends its cert with its fqdn" -> Are you sure? I can't find this mentioned in RFC 2716: PPP EAP TLS Authentication Protocol nor in RFC 3748: Extensible Aut...
Hi,that is clear, but I still don't understand the authentication. Let's loog at this from the client perspective.I'm a client, I'm connecting a Wi-Fi network, and I'm getting presented with a certificate. I can validate many parts of it, like the CA...
Hi,thanks for your reply. I know I "can" configure a wildcard FQDN in the SAN, but I'm trying to understand why. I mean: we are planning on using ISE for EAP authentication (EAP-TLS, PEAP, EAPoL) and I can't really understand why those client should ...
