topic Status cannot be changed from mydevices portal on secondary PAN in Network Access Control

Status cannot be changed from mydevices portal on secondary PAN

masyamad — Wed, 03 Oct 2018 01:46:26 GMT

Hi dev team,

I tested MyDevice portal in 2 node deployment and found an interesting behavior.

I'm not sure it's expected or incorrect behavior. Could you comment on this?

When I modify device from primary PAN, both description and status can be changed.

ex) add description and change the status to "Lost"

* Attached xlsx shows full test procedure. Please also refer it.

But when I did similar modification on secondary PAN, only description was updated.

Because it's secondary PAN, the result of status might be expected. (i.e. secondary PAN provides readonly access to registered MAC addresses).

But modification of description is still availabe even on secondary. So I'm not sure what the real expected behavior of mydevices portal is. Coud you confirm about it?

Re: Status cannot be changed from mydevices portal on secondary PAN

Nidhi — Wed, 03 Oct 2018 06:33:43 GMT

Can you access My devices link from Secondary PAN ? You can only view limited options.

Also, when you click on My devices portal from the PAN, the connection is to the PSN. you can check the address bar to confirm this.

Can you send me screenshot of your deployment page and the screenshot of your secondary PAN UI ?

Thanks,

Nidhi

Re: Status cannot be changed from mydevices portal on secondary PAN

masyamad — Wed, 03 Oct 2018 09:10:30 GMT

Hi Nidhi,

It's not BYOD but mydevices portal issue. In my understanding, the portal will be accessed by not administrator but BYOD users. So it's accessed not from PAN GUI but accessed directly from web browser with a URL like https://mydevicestest01.testcert.com/ (or https://mydevicestest02.testcert.com/ for secondary ISE) which is definied in FQDN in mydevice portal setting page.

The snapshot of configuration page.

I don't believe it's related to PAN GUI...Do I miss something?

> Can you send me screenshot of your deployment page and the screenshot of your secondary PAN UI ?

Yes.

Primary ISE

Secondary ISE

Re: Status cannot be changed from mydevices portal on secondary PAN

Nidhi — Wed, 03 Oct 2018 09:28:02 GMT

You can access it from the link - " Portal test url ' . which I thought what you did initially .

I will test this and update you soon

Re: Status cannot be changed from mydevices portal on secondary PAN

Jason Kunst — Wed, 03 Oct 2018 12:37:13 GMT

My devices and all end user facing portals run on all the policy service nodes. To access it you would either use the portal test url or the easy url fqdn created under portal settings

When using the portal test url you would need to change the IP address in the string to access other PSNs as it only uses the first psn in the registered node list

To test using the fqdn you would need to add remove each psn node to dns respectively

Keep in mind that my devices should only point to a few PSNs max for redundancy in your ha scale design

The behavior you’re listing doesn’t seem correct. Would recommend working through tac to debug as the community is not meant for break fix determination

Re: Status cannot be changed from mydevices portal on secondary PAN

masyamad — Wed, 03 Oct 2018 23:19:49 GMT

Thanks for the confirmation. Unlike sponsor portal, I could not find expected behavior of mydevices portal on secondary node so would like to know if it's expected or incorrect behavior.

* Admin guides explains about "New Guest (Sponsored or Self-registered) " or "guest password change" but doesn't mention about "new device" or "device status change".
https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_011.html#ID59

I understand it's incorrect behavior, will contact sustaining team for fixing.