300-715 · Question #180
A network administrator notices that after a company-wide shut down, many users cannot connect their laptops to the corporate SSID. What must be done to permit access in a timely manner?
The correct answer is D. Allow authentication for expired certificates within the EAP-TLS section under the allowed. If users cannot connect via EAP-TLS after a shutdown, it suggests a certificate issue, potentially due to system clock desynchronization or expired certificates. To quickly restore access, the EAP-TLS configuration should be temporarily adjusted to allow authentication with…
Question
A network administrator notices that after a company-wide shut down, many users cannot connect their laptops to the corporate SSID. What must be done to permit access in a timely manner?
Options
- AAuthenticate the user's system to the secondary Cisco ISE node and move this user to the
- BConnect this system as a guest user and then redirect the web auth protocol to log in to the
- CAdd a certificate issue from the CA server, revoke the expired certificate, and add the new
- DAllow authentication for expired certificates within the EAP-TLS section under the allowed
How the community answered
(54 responses)- A6% (3)
- B13% (7)
- C4% (2)
- D78% (42)
Why each option
If users cannot connect via EAP-TLS after a shutdown, it suggests a certificate issue, potentially due to system clock desynchronization or expired certificates. To quickly restore access, the EAP-TLS configuration should be temporarily adjusted to allow authentication with expired certificates.
Authenticating to a secondary ISE node might help if the primary is down, but it doesn't address the underlying certificate expiration or clock synchronization issue.
Connecting as a guest user is a workaround for network access but does not resolve the inability to connect to the corporate SSID via EAP-TLS and is not a timely solution for a large number of corporate users.
Adding a new certificate and revoking the expired one is the long-term solution, but it is not a timely action for many users in an immediate post-shutdown scenario.
After a company-wide shutdown, system clocks might desynchronize or certificates might have genuinely expired, causing EAP-TLS authentication to fail. Temporarily allowing authentication for expired certificates within the EAP-TLS configuration under the allowed protocols can quickly restore access while a proper certificate renewal or synchronization is performed.
Concept tested: EAP-TLS Certificate Expiration Handling
Source: https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_0100.html#concept_709EEF89FDF04505B13A7831C3D61BD6
Topics
Community Discussion
No community discussion yet for this question.