Android BYOD with NSA 2.0.0.64 failures

CarlCarlson1234 — Tue, 07 Jan 2020 18:01:48 GMT

Looking to see if anyone else is seeing a similar issue to the one that my client has. I already have a TAC case open. In 8 hours they've made no progress but claim that no one else is reporting this issue.

They're doing Dual-SSID BYOD with SCEP for certificates, and onboard through ISE using native supplicant provisioning. Windows and Apple are working fine. We had both Android 9 and 10 working using the Network Setup assistant 2.0.0.55. On December 21st Cisco updated the application to 2.0.0.64. Since that update has been pushed all on-boarding for at least Android 9 and 10 has broken. They get to the point where you download the certificates to the Phone and the app errors out with "Certificate Generation Failed". I'm able to load NSA 2.0.0.55 back on an android device and try to on-board, the whole process works as expected.

I'm aware that this is the same error that you get when you don't allow EST through, but that appears to only apply to Single SSID onboarding.

Does anyone have Dual SSID onboarding working with Android currently? I'd love to chat.

Re: Android BYOD with NSA 2.0.0.64 failures

CarlCarlson1234 — Wed, 08 Jan 2020 19:21:54 GMT

Cisco posted a bug for this, CSCvs60294. It would appear that NSA 2.0.0.64 does not play well with SCEP. Currently no fix other than to use a now unpublished version of NSA.

Re: Android BYOD with NSA 2.0.0.64 failures

hslai — Thu, 16 Jan 2020 20:21:38 GMT

I see 2.0.0.66 available at Google Play store to address this issue.

topic Android BYOD with NSA 2.0.0.64 failures in Network Access Control

Android BYOD with NSA 2.0.0.64 failures

Re: Android BYOD with NSA 2.0.0.64 failures

Re: Android BYOD with NSA 2.0.0.64 failures