topic Re: Android 10 BYOD Support in Network Access Control

Android 10 BYOD Support

CarlCarlson1234 — Tue, 15 Oct 2019 16:02:42 GMT

Android 10 is still not supported with the BYOD flow. I've tested up to 2.4 patch 10 with latest posture update. It is able to get to opening the application then the application says it can't find the session, have you logged into the portal.

There is a bug but it doesn't seem to be public yet, CSCvp32898 Day0: Android Qbeta is not able to complete the BYOD flow .

Has anyone found a work around (other than using a different product) or heard anything from Support indicating when it will be supported?

Re: Android 10 BYOD Support

Jason Kunst — Tue, 15 Oct 2019 23:55:53 GMT

Fastest route is open ticket through TAC so it gets maximum visibility

Re: Android 10 BYOD Support

CarlCarlson1234 — Tue, 29 Oct 2019 15:45:42 GMT

I have a TAC case open. I'm surprised that I don't see any other posts here for Android 10 (multiple for iOS). Does anyone else have this issue, or am I the only one lamenting this?

Re: Android 10 BYOD Support

Jason Kunst — Thu, 07 Nov 2019 19:18:09 GMT

I know there are specific issues and engineering was working a fix last week. I am not sure if they posted a new agent yet but i will check

Re: Android 10 BYOD Support

varunghildiyal66 — Thu, 14 Nov 2019 05:43:31 GMT

facing same issue in my infra, ticket is pending with development team

Re: Android 10 BYOD Support

mcamino — Tue, 26 Nov 2019 12:33:29 GMT

What is the solution?

Re: Android 10 BYOD Support

CarlCarlson1234 — Tue, 26 Nov 2019 14:40:42 GMT

No solution yet. My inc has been open for over a month, TAC tried to close it by referencing the bug I linked in my original post. I basically refused that and said it wanted it escalated. I've been told that the development team has been engaged.

Re: Android 10 BYOD Support

Jason Kunst — Tue, 26 Nov 2019 15:38:38 GMT

@CarlCarlson1234 wrote:

No solution yet. My inc has been open for over a month, TAC tried to close it by referencing the bug I linked in my original post. I basically refused that and said it wanted it escalated. I've been told that the development team has been engaged.

From http://cs.co/ise-byod issues post i have seen this one, is this the same or do you have another defect, you can also ask to escalate the case

CSCvp32898 Day0: Android Qbeta is not able to complete the BYOD flow

Re: Android 10 BYOD Support

mcamino — Tue, 26 Nov 2019 15:56:43 GMT

same bug. If i take an Android 10 device i get "certificated failed to generate" if i take identical phone on android 9, it works perfectly. Why isnt Cisco actively working this bug???

Re: Android 10 BYOD Support

Jason Kunst — Tue, 26 Nov 2019 16:11:55 GMT

@mcamino wrote:
same bug. If i take an Android 10 device i get "certificated failed to generate" if i take identical phone on android 9, it works perfectly. Why isnt Cisco actively working this bug???

they are working on it, please escalate through TAC. This is not a forum for break fix, that's the role of tac

Re: Android 10 BYOD Support

CarlCarlson1234 — Tue, 26 Nov 2019 16:40:52 GMT

To clarify, I'm hitting CSCvp23898. In the NAC app I get the error "Unable to download profile". The spw log shows "ISE is not able to apply an access policy to your log-in session at this time. Please close this browser, wait approximately one minute, and try to connect again. If you are still not able to log in, please contact your network administrator."

Certificate failed to generate may be something else...

Also, I'm interested to see if the Random Mac is actually the issue here, since you can shut that "feature" off and byod for Android 10 still doesn't work.

Re: Android 10 BYOD Support

Jason Kunst — Wed, 27 Nov 2019 16:36:46 GMT

I agree sounds like different issue. Also randomization shouldn't be issue if using single SSID. please work through TAC

Re: Android 10 BYOD Support

CarlCarlson1234 — Wed, 04 Dec 2019 16:36:38 GMT

I ran a posture update yesterday and got to Cisco supported OS Version 49. This does update ISE 2.4 for support with Android 10. I'm able to get the Cisco network setup assistant app to install certificates now. The process isn't completely clean. The app error's out and says the wireless profile couldn't be applied. But it does still configure the wireless profile.

Re: Android 10 BYOD Support

Jason Kunst — Wed, 04 Dec 2019 16:43:21 GMT

Yes i believe there are still known issues. Make sure you are running the latest app as well. Open tac case and attach to a defect. Let us know if there is a defect missing from this page as well
https://community.cisco.com/t5/security-documents/ise-byod-endpoint-notes/ta-p/3857246

Re: Android 10 BYOD Support

CarlCarlson1234 — Wed, 04 Dec 2019 16:52:04 GMT

Jason, I'm updating my post so people who find it know that there is a solution. I've had a Tac case open this entire time. Please stop telling me to open tac cases on this thread 😉

Re: Android 10 BYOD Support

marpatch — Mon, 27 Jan 2020 18:58:53 GMT

Hello,

It seems to still be an issue for many people. Has anyone tried Android 10 BYOD using a dual flow connection?

Thank You,

Re: Android 10 BYOD Support

CarlCarlson1234 — Mon, 27 Jan 2020 19:43:16 GMT

I can confirm that dual flow connection works using "Cisco supported OS version 49.0.0.0" and NSA version. 2.2.0.66 using both EST and SCEP. This is on 2.4.

NSA version 2.2.0.64 broke SCEP. v66 was released in response to that.

Re: Android 10 BYOD Support

geeyc5113 — Wed, 16 Jun 2021 00:43:34 GMT

I read through the Bugs detail, it mention the Network Setup Assistant 2.2.0.66 fixed the issue. You tested with ISE 2.4, but what is your Network Setup Assistant version? By upgrading your ISE to 2.4, it will not auto upgrade the network setup assistant to 2.4.

Re: Android 10 BYOD Support

CarlCarlson1234 — Wed, 16 Jun 2021 16:24:37 GMT

What fixed Android 10 enrollment, if I remember correctly was a posture update within ISE to Cisco supported OS version 49.0.0.0. I was probably running something like NSA 2.2.0.62.

After it was working for like a month, on December 24th of 2019 Cisco updated NSA on the Google play store to 2.2.0.64, I think, to make the Android 10 enrollment process smoother. However, this update specifically did not work with SCEP enrollment so BYOD enrollment for ALL android devices was suddenly broken for my company when we came back from Christmas break. As a result Cisco pushed 2.2.0.66 to the play store like the first or second week of January 2020 and fixed SCEP enrollment.