topic client provisioning not working on ISE after 1.2 Migration in Network Access Control

client provisioning not working on ISE after 1.2 Migration

SHANNON WYATT — Mon, 11 Mar 2019 03:50:05 GMT

Working on an initial piloted roleout of ISE with a customer. We initially had a single server setup as a pilot using 1.1.1.4 to pilot things like client supplicant provision, and then stood up a new VM as a secondary and upgraded that to 1.2. Today we tested client provisioning that work fine before, and it is failing for iOS (we haven't gotten to the other OS'es yet). What occurs is the user authenticates using PEAP and the client gets the request to install the root certificate. After this the client accepts the root certificate the connection drops. When you click the SSID to start the process again we see the redirect to the mydevices portal, but before you can click to register the client it redirected to accept the root certificate again, creating an endless loop. Has anyone else run into this bug?

client provisioning not working on ISE after 1.2 Migration

David Boos — Thu, 29 Aug 2013 18:45:57 GMT

Could you provide a screenshot of your authentication and authorization policies?

client provisioning not working on ISE after 1.2 Migration

SHANNON WYATT — Thu, 29 Aug 2013 18:51:05 GMT

Sure.

Authentication:

and

Authorization (not complete):

I've truncated them, but it is hitting the rules.

client provisioning not working on ISE after 1.2 Migration

SHANNON WYATT — Thu, 29 Aug 2013 18:56:11 GMT

The weird thing is we haven't touched any of the policies since the BYOD was in place and working, other than the upgrade of the server to 1.2. We see that redirect on the client. We do have it set to automatically update the NSP, so the NSP would be updated since the upgrade, but that is about it.

client provisioning not working on ISE after 1.2 Migration

SHANNON WYATT — Fri, 30 Aug 2013 15:01:31 GMT

Well, I figured out part of the problem. This was a controller that didn't have the captive portal disabled. I tested with a windows PC and it is working fine. Now the problem is iOS devices cant get certs from the CA (windows PCs are working fine though). I will start a new thread.

client provisioning not working on ISE after 1.2 Migration

Naveen Kumar — Sun, 01 Sep 2013 00:25:43 GMT

Please update the patch useing the below details and try it.

To upload offline client provisioning resources, complete the following steps:

Step 1 Go to the Download Software web page at http://www.cisco.com/cisco/software/navigator.html?a=a&i=rpm. You may need to provide login credentials.

Step 2 Navigate to Products > Security > Access Control and Policy > Cisco Identity Services Engine > Cisco Identity Services Engine Software.

Choose from the following Off-Line Installation Packages available for download:

•win_spw--isebundle.zip— Off-Line SPW Installation Package for Windows

•mac-spw-.zip — Off-Line SPW Installation Package for Mac OS X

•compliancemodule--isebundle.zip — Off-Line Compliance Module Installation Package

•macagent--isebundle.zip — Off-Line Mac Agent Installation Package

•nacagent--isebundle.zip — Off-Line NAC Agent Installation Package

•webagent--isebundle.zip — Off-Line Web Agent Installation Package

Step 3 Click Download or Add to Cart.

client provisioning not working on ISE after 1.2 Migration

blenka — Mon, 02 Sep 2013 20:30:59 GMT

Please go through the steps as the user guide. Page 303,326 & 447 information will help you to solve the problem.

http://www.cisco.com/en/US/docs/security/ise/1.2/user_guide/ise_ug.pdf

client provisioning not working on ISE after 1.2 Migration

SHANNON WYATT — Mon, 02 Sep 2013 21:05:17 GMT

Yes, I've been back through the guide. It is weird as it only seems to affect the iOS clients. The windows clients are working fine.

client provisioning not working on ISE after 1.2 Migration

Muhammad Munir — Tue, 03 Sep 2013 06:30:49 GMT

Ensure that a client provisioning policy exists in Cisco ISE. If yes, verify the policy identity group, conditions, and type of agent(s) defined in the policy.

Remember that the client provisioning agent installer download requires the following:

The user must allow the ActiveX installer in the browser session the first time an agent is installed on the client machine. (The client provisioning download page prompts for this.)

Check whether the proper server certificate is installed and configured for EAP by going to the Local Certificates page (Administration > System > Certificates > Local Certificates ). Also ensure that the certificate authority that signed this server certificate is correctly installed in client's supplicant. Check the previous steps in the log for this EAP-TLS conversation for a message indicating why the handshake failed. Check OpenSSLErrorMessage and OpenSSLErrorStack for more information.

Check the appropriate configuration in Policy > Authentication. This error happens when the identity source is configured for certificate-based authentication and received a password based authentication request.

Check the appropriate configuration in Policy > Authentication. This error happens when the identity source is configured for password-based authentication and received a certificate-based authentication request.

Check the connectivity between ISE and the NAD. Ensure that ISE is defined as the dynamic authorization client on NAD and that CoA is supported on device.

client provisioning not working on ISE after 1.2 Migration

SHANNON WYATT — Tue, 03 Sep 2013 12:01:49 GMT

I resubmitted this. The loop was due to auto-login, need to change the configuration on the controller to resolve that part. Provistioning works fine for windows clients, the problem is iOS clients. I will go over everything again, but I think I'm hitting a bug. I'm going to try creating a new NSP to see if that makes a difference when I get onsite.

client provisioning not working on ISE after 1.2 Migration

David Fitzgerald — Wed, 30 Oct 2013 20:11:22 GMT

I'm having similar issues. It seems that the Documenation has been updated on Oct 25, 2013, so the relative pages, p303, p326, p447 references are meaningless.

There are issues with Cisco WLCs (5508, for one) with iOS 7.02 devices. The fix is to install 7.4.115.

client provisioning not working on ISE after 1.2 Migration

hranevuts — Mon, 25 Nov 2013 10:28:13 GMT

I'm having the same issue here. In 1.1.4 the NSP is working but now after upgrade to 1.2 (with the latest patch) it's not working anymore for iOS and android. Both mobile phones are not receiving the user certificate. I checked the CA and I see that CA has issued the certificate.

Does anyone ever find out the workaround or resolution for this?

In android case, network setup assistant successfully run but I don't know if they manage to get the user certificate successfully or not since we can't see android certificate store..

In iOS case, only ise certificate is installed. It never prompts the user certificate

client provisioning not working on ISE after 1.2 Migration

David Fitzgerald — Mon, 25 Nov 2013 14:56:20 GMT

One caveat regarding the WLC 7.4.115 upgrade. Seems it is capable of disabling antennas, as well as enabling MAC Filtering, as I recall. I was sending everything via PEAP, but ISE was rejecting PAP, as not allowed.

client provisioning not working on ISE after 1.2 Migration

jgonzales2 — Tue, 26 Nov 2013 03:57:21 GMT

Have you tried changing the Client Provisioning Policy to the latest wizard for 1.2?

client provisioning not working on ISE after 1.2 Migration

hranevuts — Tue, 26 Nov 2013 13:57:31 GMT

yes client provisioning is also upgraded but not working

it seems like something breaks the certificate provisioning

the phones managed to install both CA and ISE certificates but not the user certificates

strangely all windows laptop is not affected by this..

client provisioning not working on ISE after 1.2 Migration

barryfowles — Thu, 19 Dec 2013 15:47:50 GMT

Has anyone managed to find a solution to this issue regarding Apple devices failingto provision once the ISE has been upgraded to 1.2 Patch 4. I am seeing it with Apple devices running both iOS 6 and 7 even though iOS 6 devices were working before the upgrade.

client provisioning not working on ISE after 1.2 Migration

David Boos — Thu, 19 Dec 2013 17:18:26 GMT

We did have problems but adding an ACL in our WLC to allow captive.apple.com through seemed to fix it.