Security

last person joined: 6 hours ago 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

Avaya 3645 handset 802.1x certificate issues

This thread has been viewed 0 times

  • 1.  Avaya 3645 handset 802.1x certificate issues

    Posted Feb 21, 2018 11:41 AM

    Hi all, we're trying to connect Avaya 3645 to a 802.1x network using EAP-PEAP, with ClearPass 6.6.8 as the Radius server. I can see the attempt in Access Tracker, but it is rejected with the following error: EAP-PEAP: fatal alert by client - unknown_ca TLS Handshake failed in SSL_read with error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca eap-tls: Error in establishing TLS session So obviously an issue with the Server certificate being trusted by the Avaya handset. I've exported the Radius server certificate from ClearPass, and verified that it contains the entire path - Server, Intermediate and Root certs are all contained. I have no problem importing / enrolling the cert in the Avaya handset software, but it still fails. Has anyone done this successfully?



  • 2.  RE: Avaya 3645 handset 802.1x certificate issues

    MVP EXPERT
    Posted Feb 21, 2018 12:12 PM

    Are you able to provide the full logs from within the Access Tracker entry? Does the device need to validate the Cert as I see this "unknown ca" in your logs previously provided.



  • 3.  RE: Avaya 3645 handset 802.1x certificate issues

    Posted Feb 21, 2018 03:35 PM
      |   view attached

    Log file is attached.  There's no way in the Avaya handset config to disable certificate validation.  It is very rudimentary.

    Attachment(s)

    txt
    logfile.txt   17 KB 1 version


  • 4.  RE: Avaya 3645 handset 802.1x certificate issues

    EMPLOYEE
    Posted Feb 21, 2018 03:43 PM

    Try just installing the signing/intermediate CA.



  • 5.  RE: Avaya 3645 handset 802.1x certificate issues

    Posted Feb 22, 2018 08:41 AM

    We tried the root, the intermediate and the server cert, plus all 3 combined.  Still no go.