Security

last person joined: 19 hours ago 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

Onboard 215 errors

This thread has been viewed 15 times

  • 1.  Onboard 215 errors

    Posted Aug 01, 2017 03:08 PM

    I’m having problems with getting Onboard to work in a two Clearpass cluster with publically signed certs installed for both RADIUS and https.

    I’m trying to use Onboard as the root CA.

     

    After provisioning, when the client tries to connect I get this error in Access Tracker:

     

    Error Code: 215

    Error Category: Authentication failure

    Error Message: TLS session error

     Alerts for this Request 

    RADIUS            Certificate Status unknown, Reason (UNKNOWN)

    EAP-TLS: fatal alert by server - internal_error

    TLS Handshake failed in SSL_read with error:14089086:SSL routines:ssl3_get_client_certificate:certificate verify failed

    eap-tls: Error in establishing TLS session

     

    Is this a clue?

    My Clearpass server is joined to an AD domain ending in “.local” but the public cert, obviously, does not have this ‘local’ address . Therefore the hostname and FQDN of the clearpass server match what’s in AD, not what’s on the public cert.

     

    Both the clearpass.publicaddress.com and clearpass.local have entries in the internal DNS server that the client uses. Clients do not get browser errors when browsing to clearpass.publicaddress.com

     

    Does the FQDN set in Clearpass and the public certificate name need to match? I’m hoping the answer to that is “no.”

     

    Any other ways to track down the reason for the 215 errors?

     

    Thank you.

     

     

     

     

     



  • 2.  RE: Onboard 215 errors
    Best Answer

    Posted Aug 01, 2017 03:55 PM

    Once again, problem discovered soon after posting to the world... :-)

     

    The template used to create the services added

    [EAP-TLS with OCSP Enabled] as an authentication method.

    For some reason, that method had a hard coded OCSP URL in it (did I do that, or does it come that way?)

     

    Anyway, making a new Authentication method of EAP TLS with OCSP with no OSCP URL override has things working.

     

    Thank you!