Hi, My Anyconnect clients are successfully doing cert based authentication to my ASA, and handing off Authorization to ISE. I'm using ISE as the CA and issuer for the client cert, and all is working fine. I have 4 nodes, 2 PAN/MnT, 2 PSNs. ISE is 2.2 patch 5, ASA is 9.2(3) Problem is I cannot get the OCSP responder on ISE working. On the ASA I have added all ISE's Node, CA-root, endpoint-sub-CA and OCSP responder certs to the Trusted certificate pool, which means I now have 11 Trustpoints on the ASA I've configured all the endpoint-sub-CA trustpoints to do OCSP revocation checks, pointing to the URL of one of the ISE PSNs. On ISE i've configured the OCSP Client profile to match the server URL configured above in the ASA's trustpoints. On the ASA debug I can see the revocation check being attempted against the server I've configured, but keep getting 'Failed to retrieve OCSP for trustpoint' so the revocation check doesn't happen: Failed to retrieve OCSP for trustpoint: ASDM_TrustPoint0
On the ASA logs I can see: 3 Mar 28 2018 13:58:39 717032 OCSP status check failed. Reason: OCSP Responder cert validation failed. 3 Mar 28 2018 13:58:39 717032 OCSP status check failed. Reason: Failed to verify OCSP response. Which would indicate the ASA is not trusting the OCSP responder cert from ISE - but the cert is installed on the ASA trusted certs pool, and is a trustpoint. I don't understand why the ASA is rejecting the OCSP responder cert. Does anyone have any ideas on this? I have yet failed to find a single document that covers setting up OCSP when you are using ISE as the CA and OCSP responder, so I don't know if i'm missing a step somewhere. thanks
... View more
.jpg "Hall of Fame Master"){kind=icon}
