QuestionQ46
AnalyzeA company wants its AOS-CX switches to obtain certificates from ClearPass Onboard and use those certificates to implement RadSec with ClearPass Policy Manager (CPPM).
ClearPass Onboard has a CA with EST enabled and this EST URL: https://cp1.acnsxtest.com/.well-known/est/ca:2
ClearPass Guest has an account whose username is "[email protected]." (Assume CPPM also has a valid service to authenticate users who access the EST application.)
CPPM has a network-device account for the switches with RadSec enabled. The RadSec settings validate by CN or SAN using this regex: switchcorp123
ClearPass has these certificates:
- HTTPS certificate signed by DigiCert
- RadSec certificate signed by DigiCert
- RADIUS/EAP certificate signed by MyDomainCA
This configuration is on the AOS-CX switches:
crypto pki est-profile est1
url https://clearpass1.acnsxtest.com/.well-known/est/ca:2
username switchcorp123 password plaintext %FY212h&zaTk
vrf default
exit
crypto pki certificate cert1
subject switchcorp123
enroll est-profile onboard
crypto pki application radsec-client certificate cert1
The switches’ TA-profile list includes DigiCert.
Assume you have obtained the correct password associated with the indicated username. What error or errors are present?
- A The URL in the EST profile is incorrect, and the switch does not trust a necessary CA.
- B Only the username in the EST profile is incorrect.
- C Only the URL in the EST profile is incorrect.
- D The URL in the EST profile is incorrect, and the common name in the EST profile is incorrect.
Community Discussion