1

Our ISE admin and policy nodes certs are expiring. The ISE guru who setup the whole infrastructure did a runner and the certs renewal has fallen into my lap. Last I did some ISE course must have been over 3 years ago. :-(

Following the docs, I have created for each node a multiuse csr, had them validated by our 3rd party. Next will be uploading the new certs into these pan and psn nodes for all wireless clients to start using.

Anyone who had to renew the ISE certs in the past and got it to work, are there any gotchas to watch-out for when I install the new certs and following fall-outs if any?

Thanks all in advance.

Improve this question
  • It would help if you included how you are using your ISE deployment. – YLearn♦ Sep 21 '18 at 2:29
  • @YLearn - Thanks in advance. As far as I can tell, there are 6 nodes; 2 x pan, 2 x psn and 2 x mnt. The two psn are both active and doing all the work. The clients have to accept/trust the psn certificates before using their creds to join the wireless. Have done some testing in a lab and noticed the test wireless clients have to re-accept/trust the new certs. Just wondering if anyone can relate of anyCisco 'features' to watchout for and/or unexpected 'surprises' during and after the cert renewals? – user4565 Sep 21 '18 at 5:45
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin♦ Dec 25 '18 at 9:29
2

To all, The process went smoothly towards upgrading the ISE nodes with only one hurdle.

All done from the Primary PAN, one node at a time and the Primary PAN last.

  1. Create the cert requests make them 'multiuse', download them but afterwards do NOT touch/sneeze at/delete these certs from the PAN. They are needed later.

  2. Have a 3rd party validate/create the certs required.

  3. Download your new validated certs from your 3rd party, also their Intermediate and Root certs. Upload the 3rd party Intermediate and Root certs into the Primary PAN trusted cert area.

  4. Back on the Primary PAN and in the certs request section, select a cert previously created for a particular node and 'BIND' them to the relevant cert created by the 3rd party. Next, make sure you select the other options exactly matching the older certs you are replacing.

  5. Before clicking apply, ssh into the node and monitor with the command 'show application status ise'

  6. Bind the new certs, agree/apply, monitor the node being updated via ssh and wait until all processes have restarted. Do not delete the old certs yet, the clean-up can be performed after.

  7. Test all your known OS clients available, I had a range of byod devices to test and on a couple I've had to accept the new certs.

Notes: Some of the OsX/iThingys had been previously onboarded with a dot1x profile, delete that dot1x profile and the remembered/relevant wifi connection. Then reconnect to your wifi and accept the new certs. The one hurdle and biggest nightmare of all were Win10 devices, all other OS client/devices played nicely. I now have a dream... if feasible, ban all Win10 devices from the enterprise even OsX played nice!

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.