on 10-26-2018 09:53 AM - edited on 05-10-2019 09:51 AM by Jason Kunst
During the Android BYOD Supplication Provisioning Flow, the Network Setup Assistance displays the error “Certificate Generation Failed”
Starting in Identity Services Engine (ISE) 2.2, Enrollment over Secure Transport (EST) was made externally available per RFC 7030. In section 3.3.1 of the RFC, it states “TLS server authentication with certificates MUST be supported. During the Android BYOD flow, an EST server authentication is performed for the Certificate Signing Request sent by the client device. This request is visible in the RADIUS Live logs if the Network Device Filter is set to ISE_EST_Local_Host
Quick Facts about EST on ISE:
The solution below is broken down into two sections, policy set view (default in ISE 2.3+) and standard view. Some steps outlined below may not be required to resolve this issue.
Note: If you are using the default policies and don't want to separate them you can bypass this step.
1. Cisco: cisco-av-pair Equals est-csr-request=true
OR
2. Network Access: NetworkDeviceName Equals ISE_EST_Local_Host
5. Under the Allow Protocols Column, select the Allowed Protocols option created in Step 1 Above. Once set, click Save.
1.Cisco: cisco-av-pair Equals est-csr-request=true
OR
2. Network Access: NetworkDeviceName Equals ISE_EST_Local_Host
3. Set Identity Store to All_User_ID_Stores
4. Set Allowed Protocols to EST_Android_Authentication
1. Cisco: cisco-av-pair Equals est-csr-request=true
OR
2. Network Access: NetworkDeviceName Equals ISE_EST_Local_Host
3. Set Permission to Permit Access
4. Click Save to write the configuration.
Note: If the error “Certificate Generation Failed” is still shown after making the above configuration changes, make sure the redirect ACL used for the flow allows traffic over TCP port 8084 to the ISE Policy Node(s).
Video Walkthrough available at ISE 2.2 Android Provisioning with EST Authentication (Certificate Generation Failed)
If the certificate provisioning flow fails with the policy configuration above. Please navigate to the Downloads folder on the Android device and collect the files spw.log and estlog.txt. These two logs are generated on newer Android devices to assist in diagnosing issues during the flow. Please provide these two log files to TAC if a case is opened.
Android devices utilize the Enrollment of Secure Transport (EST) service on ISE. If the service is not running, certificate generation will fail. The following warning from estlog.txt is indicative that the service on ISE is not running.
***EST [WARNING][est_client_connect:2217]-->
Unable to connect to EST server at address ise-policy.company.com
Connect to the CLI of the Policy node and issue the command "show application status ise" and validate the EST service is running.
admin# show application status ise
ISE PROCESS NAME STATE PROCESS ID
--------------------------------------------------------------------
Database Listener running 10117
Database Server running 93 PROCESSES
Application Server running 15401
Profiler Database running 11871
ISE Indexing Engine running 16828
AD Connector running 18666
M&T Session Database running 11773
M&T Log Collector running 15544
M&T Log Processor running 15452
Certificate Authority Service running 18436
EST Service running 22732
SXP Engine Service disabled
Docker Daemon running 17563
TC-NAC Service disabled
If the EST service is not running, enter the command "application start ISE" or reload the server. If the service does not move to a running state, you may be hitting a known bug documented in the Caveats section below. Please open a TAC case for assistance.
CSCvm62783 - 'EST-CSR-Request' dictionary condition does not work Impacted version: 2.4
CSCvj11319 - ISE 2.4 - EST Service not running after upgrade from 2.3
Is EST only for Android?
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: