ISE BYOD Onboarding

Hi,
I have a Lab setup with ISE 1.3, WLC 5508 7.6.130.0. I have setup the ISE using Setup Assistant as a base point and have managed to get a couple of things working, such as the Guest Portal with Self Registration, standard Wireless dot1x authentication and authorizations for notebooks using AD. I have also setup a separate Wifi network for Mobile devices using AD authentication.
All 3 scenarios work with a bit of fine tuning and with the following configurations.
Separate Guest-Wifi - Self registration - Works
Separate Corporate Wifi - AD Authentication - profiling and posture check - Works
Separate BYOD Wifi - AD Authentication - Works.
The problem I have is that when I enable device registration on the BYOD Wi-Fi, I get intermittent issues as follows:
1 Ipad connects and registers without failure, iOS 8.1.1.
other Ipad with same iOS, connects but cannot register, gets BYOD Portal page, but after accepting AUP gives error about unsupported browser.
Iphone 5s, iOS 8.1.1 connects and registers intermittently, and when it fails, it gets BYOD Portal page, but after accepting AUP gives error about unsupported browser.
Iphone 4s, iOS 8.1.1 connects but cannot register, gets BYOD Portal page, but after accepting AUP gives error about unsupported browser.
Can someone please advise why this is happening as I cannot see how its configuration error. I have checked the supported OS and Browsers for the portal and although the highest supported iOS is 8.0, why does the 1 Ipad work everytime and the Iphone 5s intermittently.
thanks.
Julian.

Supported IOS versions in ise 1.3 :http://www.cisco.com/c/en/us/td/docs/security/ise/1-3/compatibility/ise_sdt.html#49426
Client Machine Operating System
Web Browser
Supplicants (802.1X)
Apple iOS 8.0
Safari
Apple iOS Supplicant 8.0
Apple iOS 7.x11
Safari
Apple iOS Supplicant 7.x
Apple iOS 6.x
Safari
Apple iOS Supplicant 6.x
Apple iOS 5.1
Safari
Apple iOS Supplicant 5.1
Apple iOS 5.0.1
Safari
Apple iOS Supplicant 5.0.1

Similar Messages

Problems with BYOD onboarding with ISE 1.3 Internal CA

This implementation is leveraging the ISE 1.3 internal CA to enroll certs to authenticated BYOD users. The authentication/authorization profiles and policies are configured for wireless supplicant provisioning for AD authenticated IOS and Android devices.
•             When the test BYOD user with AD credentials tries to log in, they get redirected to the ISE BYOD provisioning portal.
•             They get to step 3 and successfully install the ISE certificate.
•             They then get a prompt to install the profile service (enroll an identity cert and load the wireless profile). This attempts to install for about 30 seconds and then fails with a message – ‘Profile installation Failed’ The request timed out.
The only thing I noticed that may possibly be an issue is that they are using a wild card cert signed by digicert for the ISE identity cert. Or maybe something else needs to allowed in the provisioning ACL?
I appreciate any assistance on this.

A few questions here:
1. Is this for wired or wireless BYOD
2. What version of ISE and Controller / Switch are you running
3. Post a screen shot of the Client Provisioning ACL
4. Post a screenshot of your AAA policies in ISE
The wildcard cert should not be OK as that will only be used for the HTTPs portion of the request while the EAP session would be based on the ISE CA cert.
Thank you for rating helpful posts!

I am implementing ISE BYOD.

I am implementing ISE BYOD. I get browser not supported on few of my client endpoints. Please assist on how to trouble shoot

what is ISE version and patch level you are using. is this issue particular to a end point type/OS ..
Client Machine Operating Systems and Agent Support in Cisco ISE
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/compatibility/ise_sdt.html#34998

BYOD Onboarding issue with Redirects on ISE 1.2

Hi there,
I'm having intermittent issues with onboarding endpoints (both wired and wireless) with ISE 1.2 (Patch 12).
I get three differing scenarios upon attempting:
1). I get redirected to the ISE Self Registration Portal, register, download the supplicant OK and then can browse with no problems.
2) I dont get redirected at all and so never see the Self Registration portal. All browsing tries to go to the selected website and fails (presumably as the redirect URL is in place even if the browser is not "seeing" it). If I force the browser URL to to ISE I get the Self Registration Portal displayed but with no MAC details present so I can get no further.
3) I get redirected, and seemingly Register OK, download the profiles etc...but after a "Registered Sucessfully" message, any attempt to browse to external website is again redirected to the Portal. I can then re-register again (it lets me do that as if the first time) but I just end up in that loop forever.
These problems are mostly seen wirelessly (I have a WLC 5508) but also wired clients via 3850 wired ports. I am using a collection of endpoints (Andorid, IPads, Laptops) to test and de-registering them between attempts and the results are entirely random among the three scenarios.
I am not changing any policies in between attempts so they are working fine at times, and not at others.
Any help welcome!

Hi Neno,
Thanks for your reply. I have attached some info as requested. For AuthZ rules they should first hit an EAP-MSCHAPv2 rule via the secure SSID which redirects them to the NSP process and gives them an ACL on the WLC that only allows DHCP, DNS and traffic to from ISE.
Afterward registration they should then get a certificate and then after a COA reauthenticate using EAP-TLS.
All this works fine at times, but at other times Web traffic NEVER gets redirected to ISE to begin the registration process or alternatively endpoints are STUCK in a circle of registration in that the th redirect works OK and you register OK but the redirect is permanently on and you keep getting asked to re-register your device despite the fact you have already done it once.
If you can avoid either of these scenarios, it works absolutely fine. It feels like the endpoints themselves are the issue, as I am using a small set of test devices to register (and then de-register) to test with.
However the same device that wont work at all for many many attempts, will eventually suddenly work OK and the BYOD process completes. I do however seem to have a permanent problem with Surface Pro's in that I can never get them to see the redirect at all.

ISE BYOD Android : Impossible to launch "Network setup assistant"

Hello
The Byod procedure fails when launching "Network setup assistant"
Error message is: "This profile could not be downloaded, are-you connected to Guest Portal ?"
WLC 5508 (VM) 7.5
Wlan : Flexconnect
Config : AP Flexconnect
ISE 1.3
Android 4.1.2
Here are the step:
1: Rule CWA : Redirect to Guest portal : OK
2: Rule CWA : Redirect to device portal : OK
3: Rule Android_dualSSID : Downloading "Network setup assistant" from Googleplay : OK
4: Rule Android_dualSSID : Launch "Network setup assistant 1.2.40" : NOK
Note : Profile "CWA_GooglePlay" = Redirect-ACL (NSP-ACL-Google)
The NSP-ACL-Google looks like:
(Taken from Flexconnect AP):
Extended IP access list NSP-ACL-Google
    10 permit ip any host <IP ISE>
    20 permit ip host <IP ISE> any
    30 permit udp any range 0 65535 any eq domain
    40 permit udp any eq domain any range 0 65535
    50 permit ip any 74.128.0.0 0.0.255.255
    60 permit ip 74.128.0.0 0.0.255.255 any
    70 permit ip any 173.194.0.0 0.0.255.255
    80 permit ip 173.194.0.0 0.0.255.255 any
    90 permit ip any 206.111.0.0 0.0.255.255
    100 permit ip 206.111.0.0 0.0.255.255 any
    110 permit ip any 74.125.0.0 0.0.255.255
    120 permit ip 74.125.0.0 0.0.255.255 any
    130 permit ip any 208.117.224.0 0.0.0.255
    140 permit ip 208.117.224.0 0.0.0.255 any
    150 permit ip any 216.12.120.0 0.0.0.255
    160 permit ip 216.12.120.0 0.0.0.255 any
    170 deny ip any any
Could you please help
Michel Misonne

Hello
We use the one describe in "Cisco Unified Access (UA) and Bring Your Own
Device (BYOD) CVD"
I tried also with this one:
Extended IP access list NSP-ACL-Google
    10 permit ip any host 10.35.124.195
    20 permit ip host 10.35.124.195 any
    30 permit ip any host 10.35.65.4
    40 permit ip host 10.35.65.4 any
    50 deny ip any 72.163.1.0 0.0.0.255
    60 permit ip any any
10 : ISE
20 : ISE
30 : DNS
40 : DNS
50  :Enroll.cisco.com= 72.163.1.80 ( To redirect the Network setup assistant to ISE)
(Enroll.cisco.com is the adresse that the Network setup assiatnt is tryiong to connect)
Regards
Michel

ISE BYOD with Android device

hi
i deployed ISE for BYOD and its working fine for windows and Apple devices. the issue is with android. sometimes i can register the devices in MY DEVICES portal and ISE will redirect me to download the network assistant tool. and sometimes it refuses to register the devices and its showing this error for some devices "unsupported operating system type encountered" and showing this error for the others "We are unable to determine access privileges in order to access the netwotk. Please contact your administrator"
does anyone know how to solve this issue?
thanks in advance.

Ok, so the obvious things for the first part of the problem are;
Is the Android Client using a supported OS? Check here;
http://www.cisco.com/en/US/docs/security/ise/1.1.1/compatibility/ise_sdt.html#wp80321
Are you using the latest Supplicant Provisioning plugins in ISE? And are you using the latest version of ISE?
Do the failing Clients have anything in common? Same hardware, OS Version, etc?
The second issue, where you get "We are unable to determine access privileges in order to access the netwotk. Please contact your administrator" is typically caused by one of three things. Either your Client has been idle for too long and the session has timed out, the ISE hasn't been able to Profile your device yet (and so doesn't know how to provision it), or you haven't configured ISE with an Android Supplicant Provisioning config.
Finally, I've had that last problem before, albeit on a different handset, I missed some ports/protocols/hosts on my ACL

ISE, BYOD: win clients reject ISE local-certificate

Hello!
We are deploying BYOD with Cisco ISE 1.1.2 and WLC (5508) using 802.1x authentication.
Windows clients cannot connect to 802.1x SSID with the following error on ISE:
Authentication failed : 12321 PEAP failed SSL/TLS handshake because the client rejected the ISE local-certificate
The client doesn't have preconfigured wifi profile or root certificate installed.
The concept of BYOD suppose that you can connect your device without any installed certificates and preconfigured wifi-profiles.
The problem is that Windows 7 supplicant does not send TLS alert in pop up window, when connecting to 802.1x SSID.
If this alert is seen, than you can accept it and proceed the connection. After that you will be asked to install ROOT-cert, get your own cert and etc.
So, the question is: how to make the windows supplicant to show the pop-up window with TLS alert?
p.s. the attached file shows the example of pop up TLS-alert window

Are there any recommendations from Cisco about the issue with Windows?
I believe there's a new version of smart solution design guide coming up.
The current one does not mention anything to do with certs in "User Experience" chapter.
You can check one of the possible approaches in Nico's document:
http://www.cisco.com/en/US/products/ps11640/products_configuration_example09186a0080bead09.shtml
(It can be easily expended).
I think irt. PEAP we will always say that the cert or the root/sub CA cert should be already trusted on the device when perfoming enrollment.
Will try to dig in, can't say I promise to get something concrete though.

ISE BYOD on-boarding

Hi guys.
I was watching some videos about ISE device on-boarding. How to connect to a WLAN , if employee brings his own device to a job.
There is a screenshoot of this process:
I just have one question. Employee brings his own device, we let him to authenticate, we bring him certificates and he can use EAP-TLS at the end.
But how do we know that he is our employee? Is there some steps missing ( that we need to add his device MAC address somewhere on the "WhiteList") or this is just wrong name of example, it should be guest access , not employee access on-boarding ?
What do you guys think?

Hi,
The user will have to provide AD credentials when authenticating via PEAP for example or you can have them authenticate from the webportal, or the mydevices portal, from there you can do a check based on their AD group membership to see if they are handed down the supplicant provisioning portal. This will allow you tighten down your BYOD policy.
Thanks,
Tarik Admani
*Please rate helpful posts*

ISE wired onboarding

Hi all
Is it mandatory to use EA-TLS in wired 802.1x onboarding? Or i can use PEAP-MSCHAPv2?
Challenge is customer they don't have internal CA server.
Is there any workaround on this?
The ISE application is using veriosn 1.1.3 patch 4
Thanks
Noel

You can use peap mschapv2 for onboarding, when you create the native supplication provisioning profile you have a choice for your authentication methods.
Tarik Admani
*Please rate helpful posts*

ISE, BYOD: guest clients provisioning

Hello!
The question is about provisioning different types of wifi clients through the ISE Guest portal.
ISE 1.1.4, WLC 7.4.100 (Guest WLAN uses MAB)
Suppose, there are two groups of wireless clients:
1) guest user, which credentials are created through the ISE Sponsor Portal
2) domain user, who has credentials in ActiveDirectory
The aim is to provision domain user, and not provision guest user.
When client connects to Guest SSID and opens the browser, he is redirected to ISE Guest portal.
When client uses domain user, he is provisioned, and when uses guest credentials he is not provisioned
How ISE understands, that domain user must be provisioned and guest user must not be provisioned if Web portal is configured to provision everyone?
(Web Portal -> Settings -> Enable Self-Provisioning flow)

The answer is that typically you either know that MAC address or you have someting installed (NAC agent?) and fulfill some requirements.
Alternative, you can perform CWA first (and...)
Then if user is part of guest users -> allow internet only access
If user is part of AD -> send him to do registration.
Authorization policy allows you to use "identity group" as part of condition.
If device registered -> allow full access. (just an idea).
M.

ISE , BYOD iphone issue!! client provisioning

Guys, when i sent down a profile using native suplicant for iphone, iphone gets it but it does not automatically selects TLS on the SSID.
Here is what happens:
Iphone connects to BOYD-SSID
credentials enter
client provision process
** if Auto-Login is selected problem with self registration!!!!!!!!
bunch of security errors, profile is downloaded
iphone reconnects to BOYD_SSID with credentials initilly entered (therfor MSCHAPv) not TLS
in client provisining cycle.
NOW!!!!
go back to BYOD-SSID and "forget the network", reconnect again, and manually selecting TLS and using the profile previously downloaded, and everything works!!!!
Too many freaking steps for BYOD!!!! I can't have my client tell his employees to do that.
ANy ideas.....

Marcin,
I have not had the problems you are discussing, what version of code are you running and I assume you are using the single-ssid method? In my experience I have seen where the new profile over-writes the old peap profile and after COA hits the client then uses eap-tls to connect.
Can you provide screenshots of the experiences you are having?
Thanks,
Tarik Admani
*Please rate helpful posts*

ISE BYOD Error: "We are unable to determine access privileges" on redirect

I am running ISE 1.1.1 and have gone through the design guide and setup the certificate based wireless authentication and device registration process using the ISE as a SCEP proxy for handing out certificates. On the device registration portal instead of showing the device MAC the policy services node MAC shows up and I get an error that says "We are unable to determine access privileges in order to access the network. Please contact your adiminstrator."
The an hour later I can connect just fine. The authentication logs on ISE are exactly the same in both cases. So it seems like a bug I opened a TAC case but am also posting here.

I havent opened a TAC case and havent seen this issue since when i first set this up.
Can you go to your devices portal (https://ipofise:8443/mydevices) login using your credentials and see if the device is registered or the status is set to lost. I would suggest deleting if it is there and try going through the process again.
Thanks,
Tarik Admani
*Please rate helpful posts*

ISE BYOD Microsoft SCEP NDES 802.1x The SCEP server returned an invalid response

Hello,
Using ISE 1.2 with WLC and on-boarding with single SSID. On occasion the error 'The SCEP server returned an invalid response' is received on the IPHONE being on-boarded - this is intermittent. The issue resolves itself in time. Any ideas on troubleshooting? tnks

On the NDES server regedit EnforcePassword = 0 and still having issues.
This has been done as well;
It is possible for ISE to generate URLs that are too long for the IIS web server. In order to avoid this problem, the default IIS configuration can be modified to allow for longer URLs. Enter this command from the NDES server CLI:
%systemroot%\system32\inetsrv\appcmd.exe set config /section:system.webServer/
security/requestFiltering /requestLimits.maxQueryString:"8192" /commit:apphost

ISE BYOD

Just labbing up some ISE scenarios
When I creat guest users they are in the identity store. If I use AD obviously they are in AD.
However when I have a user self provision I cannot find the identity? Where are self provisioned identities stored? They have to be somewhere so we can disable delete them etc?

You can find them in the endpoint database. Please review the below link which might be helpful on your concerns:
http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_guest_pol.html
http://www.cisco.com/en/US/docs/solutions/Enterprise/Borderless_Networks/Smart_Business_Architecture/February2012/SBA_Ent_BN_BYOD-GuestWirelessAccessDeploymentGuide-February2012.pdf

ISE used for BYOD and Corporate

Hello
I have a customer currently using EAP-PEAP on both their coporate laptop and wireless phones on different SSIDs, the radius servers are a pair of IAS servers. We have recently deployed ISE BYOD for them with a single BYOD SSID. Now they want to completely get rid of the IAS and move all Radius to ISEs but want to keep EAP-PEAP for laptops and phones.
I am thinking about the authorization rules in the ISE, now they have 3 types of access using EAP-PEAP, a user must at least belong to the Employee AD group, but he may or may not belong to BYOD or/and PHONE groups as well. The authentiation results should be something like:
1. if Corporate Laptop then Permit Access
2. if BYOD then NSP
3. if Phone then Permit Access
I am just wondering what is the best way to classify the devices (to decide the following action) without relying on profiling, Surely they all come from different SSIDs so I could check the WLAN ID to determine what action to follow, but that will need to make sure all the WLCs have the same WLAN ID for each SSID. Is there any better or neater way of doing this? What is the best practice for this kind of senario?
Thanks

If we're talking purely SSIDs, you can match the name of SSID
For example here, I'm matching a SSID of "mlatosie".

ISE BYOD Onboarding

Similar Messages

Maybe you are looking for