topic Re: BYOD broken with ANDROID 10 - Wireless Randomised MAC in Network Access Control

BYOD broken with ANDROID 10 - Wireless Randomised MAC

Scott Gillies — Thu, 10 Mar 2022 07:25:53 GMT

I have just upgraded my OnePlus 6 to Android 10. It has broken my EAPTLS BYOD service because it now automatically uses Randomised MAC when connecting to wireless networks.

My ISE authorisation policy includes the condition "MAC_in_SAN" which my device now fails on. Remove the condition and it works.

Now you can actually configure it to "Use device MAC" but the default is "Use randomised MAC (default)" BUT To add insult to injury the upgrade has also changed my device Wireless MAC address which also breaks the "MAC_in_SAN" policy condition.

Do Cisco have any guidance on this?

Re: BYOD broken with ANDROID 10 - Wireless Randomised MAC

howon — Wed, 08 Jan 2020 16:35:41 GMT

That is correct, with Android 10 BYOD registered and MAC-in-SAN condition will not work. What you have is what we recommend. https://community.cisco.com/t5/security-documents/ise-byod-endpoint-notes/ta-p/3857246#toc-hId--1243681234

Re: BYOD broken with ANDROID 10 - Wireless Randomised MAC

Scott Gillies — Fri, 10 Jan 2020 10:16:43 GMT

First, disabling the ISE policy authorisation condition MAC_in_SAN is not an option. This is part of the security and the only way to check the identity of the client device.

I have a fix for a Dual SSID BYOD solution, it's not pretty but it does work on my OnePlus Android. Here is a summary of the process.

Devices that currently use a BYOD service.

Devices that currently use a BYOD service (with certificates) but have or want to upgrade to Android 10 will have to re-on-board.

The following menu options may be different on different Android devices but the principle is the same.

Before you re-on-board

Forget both the Open and 802.1X SSID networks on your android device.
Remove the network user credentials.
On the phone: Settings -> Security -> Advanced -> Encryption -> Clear Credentials.

It is recommended to restart the device.

To on-board with Android 10

Connect to 802.1X SSID. It will fail to connect but should then show as a Saved network which should allow you to change its configuration. Configure it to “Use device MAC” (probably under Advanced -> Privicy option).
Connect to Open SSID and configure it to “Use device MAC”
Now disconnect then re-connect to the Open SSID to ensure it now uses the device MAC (perhaps try connecting and disconnecting to another SSID) and proceed with the on-boarding process.
Manually configure the 802.1X SSID with EAP Method (TLS), Certificates (CA and User) and Identity (AD username)

Hope this helps others.

Re: BYOD broken with ANDROID 10 - Wireless Randomised MAC

Dustin Anderson — Fri, 10 Jan 2020 20:20:00 GMT

The randomized mac should be a setting in the wireless/advanced. Can't you just turn it off?