Apple end points not profiling and not Communicating CoA to WLC

rschwart — Fri, 25 Oct 2019 21:51:16 GMT

We noticed recently that ISE suddenly stopped profiling Apple Devices, they would change after a few minutes to the correct profile, iPad, iPhone and OS-X. We implemented a policy to send Apple-Device to the provisioning page, this worked up until we installed patch 10 (2.4). Suddenly "all" (including all stately set) previously correctly profiled devices became Apple-Device, having to go to the provisioning portal. When portal has completed, ISE did not send the correct information to the WLC, so the clients, were sitting in non-compliant and not able to get on the wireless network. I don't know if this is patch 10 or a new profile sent down to ISE, or both. We segment mobile devices iPad etc from laptops on our wireless.

We did work with TAC and made fix, but not a solution. Users have to hit the provision portal then, turn off wireless wait 5 minutes and connect.

Any ideas, suggestions, thoughts, etc.

Thanks

Re: Apple end points not profiling and not Communicating CoA to WLC

Marius Gunnerud — Fri, 25 Oct 2019 22:13:19 GMT

How are you profiling the Mac PCs? If you are not already doing so, try profiling using DHCP option 55

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/116235-configure-ise-00.html

topic Re: Apple end points not profiling and not Communicating CoA to WLC in Network Access Control

Apple end points not profiling and not Communicating CoA to WLC

Re: Apple end points not profiling and not Communicating CoA to WLC