topic Re: ISE BYOD iOS 11 - Profile Installation Failed in Network Access Control

ISE BYOD iOS 11 - Profile Installation Failed

wileong — Thu, 25 Jan 2018 19:04:22 GMT

ISE - 2.3 Patch

iOS 11.2.2 and iOS 10.x

Tested on the above OS

BYOD flow works until installing client certificate with error of "Profile Installation Failed".

I have tried re-generating ISE Root CA and the problem persist.

Any idea?

Wing Churn

Re: ISE BYOD iOS 11 - Profile Installation Failed

Jason Kunst — Thu, 25 Jan 2018 19:09:53 GMT

If this is with a self-signed cert if will fail due to apple’s updated security mechanisms. It doesn’t happen with a well know cert

you will need to go to general > about > certificate trust settings after going thru BYOD and manually trust the server cert

then go through the BYOD flow again

Re: ISE BYOD iOS 11 - Profile Installation Failed

Jason Kunst — Thu, 25 Jan 2018 19:12:53 GMT

You can use the Mobility Deep Dive or Secure Access Wizard flow in dcloud to see a correct config with well known cert working fine.

http://cs.co/selling-ise-demos

Re: ISE BYOD iOS 11 - Profile Installation Failed

wileong — Sat, 27 Jan 2018 03:21:14 GMT

Tested that and the issue remain. Any other idea?

By the way, Windows endpoint work out just fine.

Re: ISE BYOD iOS 11 - Profile Installation Failed

hslai — Sat, 27 Jan 2018 03:33:45 GMT

Is the server certificate used for admin and portals self-signed or using an internal enterprise PKI?

Otherwise, it would NOT help to Trust manually installed certificate profiles in iOS - Apple Support

When signed by a well-known CA, please ensure the root CA certificate imported to ISE is self-signed and in the List of available trusted root certificates in iOS 11

Re: ISE BYOD iOS 11 - Profile Installation Failed

wileong — Sun, 28 Jan 2018 03:09:07 GMT

I am using ISE out-of-the-box self-signed certificate for both admin and portal.

If I understand correctly, even with in-house Microsoft PKI, I will still get the same error? The only way around it will be getting a well-known CA signed certificate?

Thanks

Wing Churn

Re: ISE BYOD iOS 11 - Profile Installation Failed

hslai — Sun, 28 Jan 2018 03:19:30 GMT

Correct.

With well-known CA, please take care of importing the root certificate that is in the trusted list in the iOS.

Re: ISE BYOD iOS 11 - Profile Installation Failed

wileong — Sun, 28 Jan 2018 03:25:07 GMT

Thanks for the swift response. By the way, does Android has the same issue?

Re: ISE BYOD iOS 11 - Profile Installation Failed

hslai — Sun, 28 Jan 2018 23:11:46 GMT

This issue is so far found to be specific to Apple iOS. ISE BYOD on Apple iOS is using Over-the-Air (OTA) provisioning without an app (Network Setup Assistant (NSA) or Supplicant Provisioning Wizard (SPW)) like what we employing on other client OS's.

Re: ISE BYOD iOS 11 - Profile Installation Failed

wileong — Tue, 30 Jan 2018 00:34:53 GMT

Hi Hsing,

I am facing the same issue for Android too. Is this issue the same as iOS?

By the way, do we have official Apple information that self-signed/internal PKI is not supported?

Thanks

Wing Churn

Re: ISE BYOD iOS 11 - Profile Installation Failed

hslai — Tue, 30 Jan 2018 00:51:23 GMT

Trust manually installed certificate profiles in iOS - Apple Support is from Apple.

I do not think Android the same issue. I've forwarded you an internal link on Android. The conditions are ISE 2.2+, Android 6+, and the latest NSA for Android at Google play store.

Re: ISE BYOD iOS 11 - Profile Installation Failed

onikaycee — Thu, 08 Mar 2018 18:12:15 GMT

hi, please i have this issue with my ipad, funny thing is the iphone is fine but ipad keeps bringing this error. how can i solve this erro

Re: ISE BYOD iOS 11 - Profile Installation Failed

wileong — Mon, 12 Mar 2018 14:53:43 GMT

Managed to get the certificate as per hslai's steps, you will need to manually trust the CA if you are using a self-sign certificate or any certificate NOT from Apple trusted CA.

Re: ISE BYOD iOS 11 - Profile Installation Failed

onikaycee — Mon, 12 Mar 2018 15:24:28 GMT

I have done this a thousand times and still comes back as failed...i am using ISE 2.2 with Patch 5. Its really frustrating

Re: ISE BYOD iOS 11 - Profile Installation Failed

wileong — Mon, 12 Mar 2018 15:30:19 GMT

I did receive the same error once even after trusting ISE certificate in iOS. What I did was regenerate ISE Root CA, maybe I mess up the CA during numerous testing.

Re: ISE BYOD iOS 11 - Profile Installation Failed

Jason Kunst — Mon, 12 Mar 2018 23:35:12 GMT

Right Apple has made real difficult if you don’t have a valid trusted cert you have to go through the flow 2x

Once to get the server cert and once you have this then you have to go to general about settings something like that to trust the cert

Then go through it again

The dCloud demo for mobility sandbox and the ise secure access wizard sandbox has ise 2.3 with well known cert. this will show the correct behavior

Re: ISE BYOD iOS 11 - Profile Installation Failed

ciscoworlds — Thu, 28 Jun 2018 10:09:42 GMT

I tested BYOD with both of iPAD Air (iOS 11.0) and Android 7.0, but was unsuccessful on both of them!

On Android after being redirected to the BYOD portal and clicking on the link to download Network Setup Assistant app, none of the browsers let me open Play.Google.com saying the certificate is untrusted (I'm using an internal MS CA). Even I downloaded that app manually and I got "Certificate Generation Failed" message like the screenshot posted before.

On Apple iOS 11, I got redirected to BYOD portal, but after clicking on the link to download Profile, it prompted me to download my internal root CA certificate (.cer file) and an .xml file, but after clicking on the Download button, it says "Download Failed".

As a result, I wasn't able to make BYOD work on ISE 2.4 patch 1 yet. I even have created a separate post about this at ISE BYOD: certificate generation failed link.