topic ISE , BYOD iphone issue!! client provisioning in Network Access Control

ISE , BYOD iphone issue!! client provisioning

Marcin Zgola — Mon, 11 Mar 2019 03:43:04 GMT

Guys, when i sent down a profile using native suplicant for iphone, iphone gets it but it does not automatically selects TLS on the SSID.

Here is what happens:

Iphone connects to BOYD-SSID

credentials enter

client provision process

** if Auto-Login is selected problem with self registration!!!!!!!!

bunch of security errors, profile is downloaded

iphone reconnects to BOYD_SSID with credentials initilly entered (therfor MSCHAPv) not TLS

in client provisining cycle.

NOW!!!!

go back to BYOD-SSID and "forget the network", reconnect again, and manually selecting TLS and using the profile previously downloaded, and everything works!!!!

Too many freaking steps for BYOD!!!! I can't have my client tell his employees to do that.

ANy ideas.....

ISE , BYOD iphone issue!! client provisioning

Tarik Admani — Thu, 01 Aug 2013 03:24:39 GMT

Marcin,

I have not had the problems you are discussing, what version of code are you running and I assume you are using the single-ssid method? In my experience I have seen where the new profile over-writes the old peap profile and after COA hits the client then uses eap-tls to connect.

Can you provide screenshots of the experiences you are having?

Thanks,

Tarik Admani
*Please rate helpful posts*

ISE , BYOD iphone issue!! client provisioning

Marcin Zgola — Thu, 01 Aug 2013 04:10:44 GMT

I can get this info to you later on tonight or tomorrow morning.

Maybe i have a problem with CoA???

Do you need version of ISE and Ipad?

Re:ISE , BYOD iphone issue!! client provisioning

Tarik Admani — Thu, 01 Aug 2013 06:24:40 GMT

It would be helpful to see screenshots of your authorization policies, and the authentications dashboard. Also some information regarding your wireless setup.

Sent from Cisco Technical Support Android App

ISE , BYOD iphone issue!! client provisioning

Marcin Zgola — Wed, 07 Aug 2013 03:49:28 GMT

i got it to work!!!

I have a problem with ANdroid connecting to google play... I am using BYOD SSID connected via FLEXCONNECT, and my ACL does not allow google play no matter where i allow that traffic.

Can you point me into right direction where to modify ACL to allow google play during provisioning process.

Re: ISE , BYOD iphone issue!! client provisioning

Tarik Admani — Wed, 07 Aug 2013 04:00:03 GMT

Hi,

Do you have the contents of the acl? Also where are you applying this acl? I have had challenges in deploying flexconnect with ISE but lets see how the client entry looks and what state the client is in when you hand down the provisioning acl from ISE.

Thanks,

Sent from Cisco Technical Support iPad App

ISE , BYOD iphone issue!! client provisioning

Marcin Zgola — Wed, 07 Aug 2013 16:45:18 GMT

I applied to the FLEXCONNECT WEB POLICY as it says in the PDF.

Re: ISE , BYOD iphone issue!! client provisioning

Marcin Zgola — Wed, 07 Aug 2013 20:14:50 GMT

in this state using flex connect i need to go to google play.. and it does not work

ISE , BYOD iphone issue!! client provisioning

blenka — Thu, 15 Aug 2013 00:27:38 GMT

Please find the link information all the configuration for client provisioning.

http://www.cisco.com/en/US/docs/security/ise/1.1.1/user_guide/ise_client_prov.html

What did you do to fix the

hermodfinjord — Wed, 19 Mar 2014 12:59:13 GMT

What did you do to fix the problem with Auto-Login. I have the same problem!

hi one o four client having

vasanthmanoharan — Mon, 07 Jul 2014 10:52:12 GMT

hi one o four client having registration problem we have registered the client mac but every day its promoting to registration please help me

screen shot attached....

the iphone model is 5c and latest ios version

This one fixed my problem:

hermodfinjord — Thu, 14 Aug 2014 07:25:51 GMT

This one fixed my problem: http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/116041-solution-apple-osx-00.html

Hi All,

LudovicDS — Mon, 02 Nov 2015 11:31:41 GMT

Hi All,

I have the same problem for iOS devices.

With the same configuration i have problems with Iphone 6 version 9.0.1 but not with iphone 4

So the problem seems not to be in CoA but in iOS process.

With Iphone 6 i need to " forgot the network" and then specified TLS configuration and choose username authentication + certificate that will be used for this username.

regards

Hi All,

LudovicDS — Tue, 16 Feb 2016 15:26:14 GMT

Hi All,

I have the same problem for iOS devices.

With the same configuration i have problems with Iphone 6 version 9.0.1 but not with iphone 4

So the problem seems not to be in CoA but in iOS process.

With Iphone 6 i need to " forgot the network" and then specified TLS configuration and choose username authentication + certificate that will be used for this username.

Impossible to explain to our customer.

regards

Re: ISE , BYOD iphone issue!! client provisioning

Ashley Sahonta — Wed, 08 Aug 2018 10:21:21 GMT

This has been reportedly fixed, as stated in the following link here.

My question is, what is the fix? Is it a workaround or is the client provisioning as simple as it used to be?

Re: ISE , BYOD iphone issue!! client provisioning

ReFeeL — Thu, 26 Jan 2023 11:13:56 GMT

I have the same problem for iOS devices. after downloading profile iphone does not automatically selects TLS on the SSID. it reconnects with PEAP.

it needs "forget the network" and reconnect again with manually selecting TLS and using the profile previously downloaded.

Is it normal for iOS devices ?

Re: ISE , BYOD iphone issue!! client provisioning

ahollifield — Thu, 26 Jan 2023 14:16:02 GMT

IMHO, an MDM should really be used these days as Apple and Google continue to lock down mobile devices. However this thread is originally from 2013 (10 years old!) so better to start a new discussion around your issue.