Security

 View Only
last person joined: yesterday 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

eap-tls: Error in establishing TLS session

This thread has been viewed 18 times

  • 1.  eap-tls: Error in establishing TLS session

    Posted 2 days ago

    I have GPO that push out the machine certificate to the windows 11 machines.  We have a few machines that are not able to connect to the SSID and when I look at the clearpass logs I get this error below.  I compare the thumbprint and cert on the one that are working and the one that is not working.  Everything looks the same as to the certificate and running netsh wlan show profile command.  I ran the pcap and there is nothing that pop out telling me what the client was denied.  I am hoping someone can assist me or know the issue.

    Error Code:
    215
    Error Category:
    Authentication failure
    Error Message:
    TLS session error
     Alerts for this Request 
    RADIUS EAP-TLS: fatal alert by client - access_denied
    eap-tls: Error in establishing TLS session


  • 2.  RE: eap-tls: Error in establishing TLS session

    Posted 2 days ago

    Hi

    In the certificates do you have the same format of the common name and SAN on the machines working and not working?

    In your AD source what is the query to find to computer account?

    Can you from the Access Tracker dialogue click the button Show Logs and paste the log



    ------------------------------
    Best Regards
    Jonas Hammarbäck
    MVP Guru 2024, ACEX, ACDX #1600, ACCX #1335, ACX-Network Security, Aruba SME, ACMP, ACSA
    Aranya AB
    If you find my answer useful, consider giving kudos and/or mark as solution
    ------------------------------

    Original Message


  • 3.  RE: eap-tls: Error in establishing TLS session

    Posted 2 days ago

    Hi Jonas

    I confirm SAN information is the same on both computer.   Not sure i understand what you mean by query but we use itune as compliance check.  here is the show logs:

    Login Status:
    REJECT
    Session Identifier:
    R0000100c-08-66c32b12
    Date and Time:
    Aug 19, 2024 12:23:00 BST
    End-Host Identifier:
    End-Host Profile:
    Computer / Windows / Windows 10.0.19042.1826
    End-Host Status:
    Known
    Username:
    host/US-SO-ALM-05924.pharms-services.com
    Access Device IP (Port):
    10.32.190.50
    Access Device Name:
    169.254.1.1
     
    System Posture Status:
    UNKNOWN (100)
     
    Policies Used -
    Service:
    Almac - EAP-TLS WLAN
    Authentication Method:
    EAP-TLS
    Authentication Source:
    Local:localhost
    Authorization Source:
    Almac-Microsoft-inTune
    Roles:
    B1, US-SO-ALM-05924
    Enforcement Profiles:
    ALMAC-B1
    Service Monitor Mode:
    Disabled
    Online Status:
    Not Available

    Original Message


  • 4.  RE: eap-tls: Error in establishing TLS session

    Posted 2 days ago

    fatal alert by client - access_denied; suggests that the client has an issue with what ClearPass sends. So that may be the EAP certificate, or the SAN(s) not matching the RADIUS Server name that you configured for the client. It might also be that the client certificate is locked (password), or not present. Maybe you can find something in the Event Viewer on your client?

    Clock (time) is set correctly on all of your clients?



    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------

    Original Message


  • 5.  RE: eap-tls: Error in establishing TLS session

    Posted 2 days ago

    Since this is a machine certificate, why would it work from majority of the machine and just only a few.  The time is correct and we made sure it is sync correctly.  I compare pretty much everything from the working machine and also import the same cert from the clearpass server but no luck.


    Original Message


  • 6.  RE: eap-tls: Error in establishing TLS session

    Posted 21 hours ago

    Hi.

    This looks like more AD problem than Clearpass problem. Check machine account in AD. Access Denied suggest that AD is not happy with the machine credentials.

    Did you check Windows event log for clues?

    Best, Gorazd



    ------------------------------
    Gorazd Kikelj
    MVP Guru 2024
    ------------------------------

    Original Message


  • 7.  RE: eap-tls: Error in establishing TLS session

    MVP
    Posted 16 hours ago

    Assuming you are using ClearPass 6.11.x or newer, by default there is a new TLS encryoption enabled that does not work with come earlier TPM chips.

    IMO the best solution is to disable it for every server in the cluster.

    Administration -> Server configuration -> [CPPM node] -> Service parameters ->Radius server -> TLS -> Disable RSA-PSS signature Suite in EAP-TLS

    Set from FALSE to TRUE

    Save for each node in the cluster.



    ------------------------------
    Bruce Osborne ACCP ACMP
    Liberty University

    The views expressed here are my personal views and not those of my employer
    ------------------------------

    Original Message