Security

last person joined: yesterday 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

Activating OCSP check after client onboard the device

This thread has been viewed 1 times

  • 1.  Activating OCSP check after client onboard the device

    Posted Jan 13, 2014 10:57 PM

    Hi Guys,

     

    I'm currently using the EAP-TLS authentication method and ClearPass is acting as the CA server. I noticed that after I revoke the client certificate from the onboard module, the client still able to connect to the network.

    After done searching the solution that I need to enable OCSP feature on the CA configuration and change the authentication method with EAP-TLS with OCSP enable with the URL referring to the configuration URL inside the CA.

     

    My question is, do I need to re-onboard all the client devices to make it work?

     

    Thanks guys

    Erik



  • 2.  RE: Activating OCSP check after client onboard the device

    EMPLOYEE
    Posted Jan 13, 2014 11:26 PM
    @eriksetiadi wrote:

    Hi Guys,

     

    I'm currently using the EAP-TLS authentication method and ClearPass is acting as the CA server. I noticed that after I revoke the client certificate from the onboard module, the client still able to connect to the network.

    After done searching the solution that I need to enable OCSP feature on the CA configuration and change the authentication method with EAP-TLS with OCSP enable with the URL referring to the configuration URL inside the CA.

     

    My question is, do I need to re-onboard all the client devices to make it work?

     

    Thanks guys

    Erik

    So, if you did not enable it initially in the CA, it will not be in certificates that have already been issued, so CPPM cannot read it.  You would have to enable "Override from Client" and enter the OCSP URL manually.

     

     



  • 3.  RE: Activating OCSP check after client onboard the device

    Posted Jan 14, 2014 12:32 AM

    So your saying is, if I'm enabling the URL override inside the EAP-TLS authentication method configuration below and put the same URL that ClearPass CA page generate that I don't have to re-onboard all the end devices?

     

    Override OCSP URL.png

     

     



  • 4.  RE: Activating OCSP check after client onboard the device

    EMPLOYEE
    Posted Jan 14, 2014 04:17 AM

    Correct.