topic Re: Google Pixel2 / Android 9.0 / Fails dual-SSID BYOD in Network Access Control

Google Pixel2 / Android 9.0 / Fails dual-SSID BYOD

jasonm002 — Mon, 27 Aug 2018 14:48:33 GMT

Is anyone else able to try a Google Pixel2 phone running Android 9.0 with dual-SSID BYOD? Have a TAC case open but would be interesting to see if anyone else is having the same issue. The error is that the phone is unable to download the profile from ISE. Any other Android phone I try is fine, such as a LG Nexus 5X running 8.0, or a Samsung Galaxy S6 on 7.0, or even an old LG tablet running 4.4. The process also worked on a Pixel 2 running 8.1 in the past, it seems 9.0 broke it.

In the SPW.log from the Pixel 2 phone running 9.0 we see the following messages of interest, but I did not paste the entire log:

2018.08.17 10:02:53 INFO:Discovered ise server = <server FQDN>
2018.08.17 10:02:53 INFO:Discovered client mac = 02-00-00-00-00-00
2018.08.17 10:02:53 INFO:askPermissionForDownload - request permission from user to download the profile from the discovered ISE host

...

<td>
ISE is not able to apply an access policy to your log-in session at this time. Please close this browser, wait approximately one minute, and try to connect again. If you are still not able to log in, please contact your network administrator.
</td>

Re: Google Pixel2 / Android 9.0 / Fails dual-SSID BYOD

hslai — Thu, 30 Aug 2018 02:25:32 GMT

ISE has not yet supporting Android 9.0 (Pie). It's being tracked by CSCvm10640 internally.

Re: Google Pixel2 / Android 9.0 / Fails dual-SSID BYOD

jasonm002 — Thu, 30 Aug 2018 13:21:44 GMT

Any indication of when it will be supported? It seems like an app/API issue. We're an educational institution that just deployed BYOD as a new service and now we're going to launch into the beginning of the semester with a popular phone not supported, which will damage public perception of the new service, and by extension their opinion of Cisco. I don't think anyone wants any of those things, so hoping for a quick solution to this.

Re: Google Pixel2 / Android 9.0 / Fails dual-SSID BYOD

hslai — Thu, 30 Aug 2018 16:11:39 GMT

I am checking with our dev team.

Re: Google Pixel2 / Android 9.0 / Fails dual-SSID BYOD

suporte.it@telemont — Mon, 10 Sep 2018 20:32:52 GMT

We have a customer with the same problem as above, on a Dual SSID provisioning. He is running android 9.0 Custom ROM (LineageOS) on a Xiaomi Mi 5 device.

Re: Google Pixel2 / Android 9.0 / Fails dual-SSID BYOD

Jason Kunst — Mon, 10 Sep 2018 20:39:11 GMT

please make sure you log a case through the TAC as well

Re: Google Pixel2 / Android 9.0 / Fails dual-SSID BYOD

jasonm002 — Tue, 11 Sep 2018 08:33:47 GMT

Can we get an update from development on this one? It seems it's just an issue with Android 9 breaking the app. The client's MAC is recorded by the app as "02-00-00-00-00-00" in my case in the SPW.log. Seems like it's just an API change in 9.0, might just require a branch to detect 9.0 and use a different function to get the MAC -- not sure, but imagine it's probably not a difficult fix for Cisco.

Re: Google Pixel2 / Android 9.0 / Fails dual-SSID BYOD

maychida — Thu, 08 Nov 2018 07:23:33 GMT

Hi HSLAI,

Any update from Dev on which ISE version would support Android 9 and an ETA on the same? I see the Feed service update did not help either for my customer?

-
Regards,
Mayil Raj

Re: Google Pixel2 / Android 9.0 / Fails dual-SSID BYOD

Jason Kunst — Thu, 08 Nov 2018 14:03:52 GMT

Recommend a tac case. For anyone that has one please share the defect Id

I will check internally

Re: Google Pixel2 / Android 9.0 / Fails dual-SSID BYOD

Jason Kunst — Fri, 09 Nov 2018 14:08:29 GMT

Here is the bug “CSCvm10640”. Please work through TAC on this

Right now it doesn’t look like these devices are honoring the certificate SAN field and likely an android issue being investigated

I would also recommend contacting the os provider

Re: Google Pixel2 / Android 9.0 / Fails dual-SSID BYOD

Louis Gonzales — Mon, 14 Jan 2019 15:59:49 GMT

I've already logged a TAC case but wanted to see if there has been any update on this. More people in our organization are getting Google Pixel 3 phones which come with Android 9 out of the box and are not able to connect to our corporate BYOD network. This is becoming a bigger problem as we are moving away from using PSK for our SSIDs.

Re: Google Pixel2 / Android 9.0 / Fails dual-SSID BYOD

hslai — Mon, 14 Jan 2019 16:02:28 GMT

Our developer is working with Android dev team to fix this. No ETA yet.

Re: Google Pixel2 / Android 9.0 / Fails dual-SSID BYOD

jasonm002 — Mon, 14 Jan 2019 19:59:27 GMT

Does the issue persist if you have client provisioning feed enabled in ISE and set to

Enable provisioning: Enable

Enable automatic download: enable

Update feed URL: https://www.cisco.com/web/secure/spa/provisioning-update.xml

Native supplicant provisioning policy unavailable: allow network access

TAC basically told me to make sure I had provisioning enabled (which I did, set to those settings above) and at some point our Pixel2 users started working with BYOD and EAP-TLS on ISE 2.4 p2+struts fix using the ISE internal CA. Not sure what fixed it, not sure if it's still broken on Pixel3 phones because I haven't had a pixel3 user come forward with the issue.

Re: Google Pixel2 / Android 9.0 / Fails dual-SSID BYOD

hslai — Mon, 14 Jan 2019 20:27:06 GMT

The dual-SSID BYOD with Android 9 should be working at this point, but you might get some benign error "Unable to connect. Please manually connect to SSID: ..."

The main issue we are working with Android dev team on CSCvm10640 is to be able to either forget or modify an existing SSID in the single-SSID BYOD flow.

Re: Google Pixel2 / Android 9.0 / Fails dual-SSID BYOD

jasonm002 — Mon, 14 Jan 2019 20:51:18 GMT

Yes that's a good point: we're using dual-ssid BYOD, forgot to mention that.

Can you comment on what fixed it in the dual-ssid flow? Was it the provisioning feed update? I closed my TAC case because it was fixed but unfortunately they didn't seem to know what fixed it exactly; I just assumed it was the provisioning feed update as the only patch I applied to ISE 2.4p2 by that point was the struts fix.

Re: Google Pixel2 / Android 9.0 / Fails dual-SSID BYOD

hslai — Mon, 14 Jan 2019 22:03:30 GMT

I am not sure what exactly fixed in your deployment.

Generally to support a new client OS, we need the following:

Cisco supported OS version up-to-date -- done via ISE posture feed update
Network Setup Assistant latest for non-Apple-iOS devices -- Android NSA, available via Google Play store, last updated in 2017 so no change yet for Android 9.
Web browser support -- newer Chrome browser releases may not connect to ISE portal pages unless the hostname/FQDN matched in the certificate SAN field. ISE 2.3 needs this for the system certificate(s) used by the ISE guest/BYOD portals; earlier ISE releases might need the same by the ISE admin portal.

Re: Google Pixel2 / Android 9.0 / Fails dual-SSID BYOD

jasonm002 — Mon, 14 Jan 2019 23:43:41 GMT

Alright so based on your input it is probably the posture feed update that did it then.

So perhaps the other users here just need to make sure the posture feed is auto updating from the appropriate URL for your ISE version, e.g. https://community.cisco.com/t5/identity-services-engine-ise/ise-urls-for-external-service-updates/td-p/3526841

Re: Google Pixel2 / Android 9.0 / Fails dual-SSID BYOD

suporte.it@telemont — Fri, 01 Mar 2019 17:41:32 GMT

Has this been fixed in ISE 2.6?

Re: Google Pixel2 / Android 9.0 / Fails dual-SSID BYOD

mgrecner — Wed, 17 Apr 2019 10:57:12 GMT

We are hitting the same problem with Android 9, fully updated ISE 2.2, newest version 2.2.0.55 of Cisco app. I find it hard to believe this is not fixed yet, being a known problem since August 2018, can someone please suggest what to do ?
Thank you very much.

Re: Google Pixel2 / Android 9.0 / Fails dual-SSID BYOD

jasonm002 — Wed, 17 Apr 2019 12:28:39 GMT

Make sure the client provisioning and posture feeds are updated with the correct URLs according to ISE 2.2 docs and optionally enable auto update.

This was fixed back in October I think for ISE 2.4; I'm not sure about 2.2. ISE 2.4 is now the recommended release. It's possible there is also some other configuration issue with the deployment so you should probably try the above and then make a TAC case if that doesn't work.