OCSP and Live Logs

[russell.sage]

I have a customer who has laptops with a VPN client and a certificate issued via SCEPMAN. The VPN client connects to Netmotion which in turn sends a radius request to the ISE for the client certificate to be checked against SCEPMAN and the result passed back to Netmotion to accept or reject the connection request from the user. This works. The strange thing is I see nothing in the Live Logs on the ISE box. A TCP dump shows the entire exchange. A valid certificate return a RADIUS access-accept and a revoked certificate an access-reject.

Secondly this doesn't seem to hit any policy set. Does the enabling of OCSP override policy sets?

Is there some setting in ISE that needs to be turned on to see this activity in the live logs?

I can find no policy set library or dictionary for handling OCSP activity.

[ahollifield]

I don't think ISE is evaluating the certificate in this scenario.  If this is like ASA/FTD the certificate validation occurs on the headend and "Auhorize-only" is configured for ISE.  Not sure if that same concept exists in Netmotion.  

Do all live logs not work?  Or only this one scenario? https://www.adamhollifield.com/2022/09/fix-cisco-ise-messaging-service.html

[russell.sage]

Hi don't expect ISE to evaluate the certificate I would expect ISE to make an OCSP request to SCEPMAN and that does appear to be happening. So are you saying if ISE doesn't evaluate the certificate then nothing should be seen in the Live logs even though ISE is receiving RADIUS requests.

[ahollifield]

Maybe I’m not following here. What is being via RADIUS to ISE? The certificate? Username? Something else?

[russell.sage]

Its probably me. Netmotion makes a radius request to ISE for access by requesting that ISE conduct a certificate revocation check with SCEPMAN. If the customer uses a revoked certificate ISE sends backs a radius access-reject message else if the certificate is valid it returns a RADIUS access-accept message. My question is I don't see how you build that into a policy set. There is no library or dictionary for OCSP. Under Authentication policy I can do a check for Network Access-EapAuthentication equals EAP-TLS but that seems a bit pointless. So at present I am authenticating using the default with the option if Auth fails to reject. I don't see how Authorisation comes into play at all.

RADIUS live logs show nothing at all. 

[ahollifield]

Right that's exactly what's not making sense to me.  What type of RADIUS request is this?  Is it EAP?  How exactly is the certificate flowing from Netmotion to ISE?  Is it the entire certificate or just the common name?  Why is Netmotion using ISE at all and not just talking to SCEPMAN directly for OCSP?

Do you have any other Live Logs in this deployment?  Or is this the only thing ISE is being used for?

[Greg Gibbs · Accepted solution]

When enabled on the Trusted Certificate, OSCP (and CRL) checks for certificate revocation are something that happens as part of the Authentication Process. There are no dictionaries for manipulating those checks.

In ISE, the MAC address is the essential key to how a RADIUS session is created and tracked. My guess would be that Netmotion is not providing a MAC address as part of the RADIUS request and so ISE does not have a way to insert the session into the live logs or other normal processes.

You would likely need to do a TCPdump on ISE to capture the RADIUS traffic from Netmotion to see how it is constructing that. This is certainly not a use case I've ever heard of ISE being used for before.

[russell.sage]

Greg many thanks. A tcp dump of the RADIUS traffic coming from Netmotion doesn't include a Called-Station ID with mac address. Just a NAS Identifier. I will feedback to the Netmotion team.