topic Re: ISE BYOD with Android device in Network Access Control

ISE BYOD with Android device

Ibrahim Jamil Jamus — Mon, 11 Mar 2019 03:29:16 GMT

i deployed ISE for BYOD and its working fine for windows and Apple devices. the issue is with android. sometimes i can register the devices in MY DEVICES portal and ISE will redirect me to download the network assistant tool. and sometimes it refuses to register the devices and its showing this error for some devices "unsupported operating system type encountered" and showing this error for the others "We are unable to determine access privileges in order to access the netwotk. Please contact your administrator"

does anyone know how to solve this issue?

thanks in advance.

Re: ISE BYOD with Android device

Richard Atkin — Thu, 30 May 2013 16:27:35 GMT

Which ports and protocols have you allowed out to the Internet?

Sent from Cisco Technical Support iPad App

Re: ISE BYOD with Android device

Ibrahim Jamil Jamus — Fri, 31 May 2013 11:42:22 GMT

well i opened all the ports to google, samsung, and sony App Stores Public IP addresses.

btw i want to add another issue. when Android devices register with ISE, then ISE redirect the device to play.google.com to download the Network Assistant tool. the device can download the software but it can't install it because the file type is not recognized by the device.

Note: i made the test with Sony Xperia

Re: ISE BYOD with Android device

Richard Atkin — Fri, 31 May 2013 13:03:46 GMT

Ok, so the obvious things for the first part of the problem are;

Is the Android Client using a supported OS? Check here;

http://www.cisco.com/en/US/docs/security/ise/1.1.1/compatibility/ise_sdt.html#wp80321

Are you using the latest Supplicant Provisioning plugins in ISE? And are you using the latest version of ISE?

Do the failing Clients have anything in common? Same hardware, OS Version, etc?

The second issue, where you get "We are unable to determine access privileges in order to access the netwotk. Please contact your administrator" is typically caused by one of three things. Either your Client has been idle for too long and the session has timed out, the ISE hasn't been able to Profile your device yet (and so doesn't know how to provision it), or you haven't configured ISE with an Android Supplicant Provisioning config.

Finally, I've had that last problem before, albeit on a different handset, I missed some ports/protocols/hosts on my ACL

Re: ISE BYOD with Android device

Ibrahim Jamil Jamus — Sat, 01 Jun 2013 07:18:39 GMT

That Richard for your reply.

here is the answers for your questions.

Is the Android Client using a supported OS?

yes it is.

Are you using the latest Supplicant Provisioning plugins in ISE? And are you using the latest version of ISE?

im using 1.1.4.218, and i think i have the latest supplicant provisioning plugins cause i run the updates almost every week and i cant find any newer plugins. is there is any Cisco document that has the latest plugins versions.

Do the failing Clients have anything in common? Same hardware, OS Version, etc?

no, diffirent hardware and OS versions.

For the second issue, yes it was because of the max. idle time.

for the third one, can you tell me what do i have to add more to the ACLs.

Re: ISE BYOD with Android device

Jatin Katyal — Sat, 01 Jun 2013 12:14:52 GMT

Ibrahim,

The "View Full Website" option available in many mobile browsers causes it to send false information regarding the OS in use so sending a false OS interferes with the self-provisioning flow on ISE, preventing the registration of the device.

Disable the "View Full Website" (or similar) option during the registration process and see if it helps.

I think there was an enhancement filed regarding the same, will find and provide you the same.

Regards,

Jatin

-Do rate helpful posts-

Re: ISE BYOD with Android device

Ibrahim Jamil Jamus — Sun, 02 Jun 2013 08:40:38 GMT

Jatin,

thanks for your reply. really appreciate your effort.

but in my case i have 5000 users and more than 10000 endpoints. you can do the math . i guess there is something missing here.

for the other issues, The reason is the ACL, i didnt permit the access to all play.google.com IP addresses. so it was my mistake.

thanks alot guys for your help.

Re: ISE BYOD with Android device

Jatin Katyal — Sun, 02 Jun 2013 09:00:23 GMT

10000 endpoints with this issue...I understand 🙂

I was able to find a product enhancement request on this matter.

CSCud86946 Add hint to SPP "OS Not Supported" page re:Android "Full Website" option

From the description of the Enhancement:

This is an enhancement request to add a message to Android users prompting them to investigate whether this type of option is set in their web browser. Long term, it would be ideal if we had a more graceful way to handle this issue but adding a simple message to the user should improve their experience through self help.

You may contact your cisco accounts team so that they can talk to ISE BU to get this addresses soon.

Have a blessed day !!!

Jatin Katyal
- Do rate helpful posts -

Re: ISE BYOD with Android device

Ibrahim Jamil Jamus — Sun, 02 Jun 2013 09:57:13 GMT

well not all the 10000 devices are android devices. but it should be a huge number .

btw i tried to register the devices with this error from a diffirent browser and it works for me. PS: i used the devices default browser.

thanks again bro for your effort.

im still stuck with the "Package is invalid" error when i download Network setup tool from the BYOD SSID guys. if anyone know what is the solution please let me know.