topic ISE 1.1.1 Android supplicant in Network Access Control

ISE 1.1.1 Android supplicant

kev-matthews — Mon, 11 Mar 2019 02:22:40 GMT

Hi Folks,

I'm giving ISE 1.1.1 a go in the lab before I deploy it into our live wireless and I've hit a problem with the Android supplicant. I've finally gotten iOS to register and obtain the wireless profile, but when we try with an Android, the device registers and we download the supplicant software from the Google Play (so far so good) but once the software opens it starts the provisioning process and returns 'unable to locate server'. Looking at the registration flow, it would appear that its unable to relocate the ISE. Is there anything that I've missed? Our provisioning ACL on the WLC allows full access to the ISE, any DNS and any port 5228 (google play).

Any help would be amazing as its starting to drive me a bit crazy!

Thanks

Kev

Sent from Cisco Technical Support iPad App

ISE 1.1.1 Android supplicant

Amjad Abdullah — Mon, 06 Aug 2012 07:04:03 GMT

Hi Kev,

You better move your thread to the AAA and Identity forum:

https://supportforums.cisco.com/community/netpro/security/aaa

They'll help you better with the ISE part.

Amjad

ISE 1.1.1 Android supplicant

kev-matthews — Mon, 06 Aug 2012 07:26:00 GMT

Thanks Amjad

ISE 1.1.1 Android supplicant

Pongsatorn Maneesud — Mon, 06 Aug 2012 09:10:33 GMT

Can you check your DNS again, try to access the Play Store from any Laptop browser.

May be your DNS cannot solve the Play Store either the DNS forwarder is not set properly.

DNS is very important for Identity Service Engine.

Cheers,

Pongsatorn M.

ISE 1.1.1 Android supplicant

kev-matthews — Mon, 06 Aug 2012 09:19:11 GMT

Hi, yes we can access the play store as we can download and install the SPW to the android device. Once the client is launched it shows the error "unable to locate server", so it would seem that it's unable to locate the ISE.

Re: ISE 1.1.1 Android supplicant

Tarik Admani — Mon, 06 Aug 2012 10:25:15 GMT

I ran into this issue also and will debug the issue in a day or two. I gt this to work once but will remove my cert and eat work profile to see what is going on.

Sent from Cisco Technical Support iPad App

Re: ISE 1.1.1 Android supplicant

Tarik Admani — Mon, 06 Aug 2012 19:33:01 GMT

I upgraded my OS to ice cream sandwich and it worked fine with Opera, i ran into some issues with firefox (screenshot attached). I will keep trying to see if this occurs again.

Tarik Admani
*Please rate helpful posts*

Re: ISE 1.1.1 Android supplicant

kev-matthews — Tue, 07 Aug 2012 07:16:20 GMT

Thanks Tarik, That's different to what we've seen, we get an error when the actual supplicant application is launched (the SPW from the Google Play store).

Re: ISE 1.1.1 Android supplicant

Tarik Admani — Tue, 07 Aug 2012 07:19:06 GMT

Not a problem, I was receivng the same error also and thought I could reproduce this for you but when i tested it this morning it started to work. See if you can uninstall and reinstall the app to see if that fixes the issue.

Thanks,

Tarik Admani
*Please rate helpful posts*

Re: ISE 1.1.1 Android supplicant

Tarik Admani — Wed, 08 Aug 2012 04:30:11 GMT

I wanted to know how your ACLs are configured for your supplicant provision authorization policy. Try not to restrict any ports at the moment and see if the android client connects.

Thanks,

Tarik Admani
*Please rate helpful posts*

Re: ISE 1.1.1 Android supplicant

kev-matthews — Wed, 08 Aug 2012 08:13:49 GMT

Hi Tarik,

I've attached a copy of our ACL - 10.10.10.70 is the ISE, and then port 5228 is for the Google Play store.

I've heard that you may need to put a deny in for HTTP requests to the default gateway, but I would assume that would be covered by the implicit deny?

Thanks Kev