topic Re: ISE 2.2P4 Apple iPhone7 vers 11 BYOD will not Register in Network Access Control

ISE 2.2P4 Apple iPhone7 vers 11 BYOD will not Register

aprildanos — Mon, 20 Nov 2017 20:38:56 GMT

2 node deployment. Cannot get my iPhone to register to ISE BYOD portal. Fails when installing Profile Service with an invalid server certificate.

Have tried:

1) Active Directory Server as the Root and ISE as a Subordinate CA

2) ISE is the Root CA

Either way it fails at the install Profile Service part. The profile is green and says it has been verified. Windows SPW works fine.

I have gone into Settings > About > etc on the phone and trusted the ISE root certificate. Running the logs on iOS console have not yielded any information. Was getting same results on iOS 10.3.

The ISE is trying to install 4 certs: Endpoints, ISE Root, ISE Services and ISE SubCA

The iPhone did register on time with my AD server as the Root CA over ISE but that was only once.

Have TAC case open and making no headway other than to possibly recommend I call Apple.

Do you have any suggestions as I am at the end of the line to get ISE BYOD and Apple working.

Re: ISE 2.2P4 Apple iPhone7 vers 11 BYOD will not Register

Jason Kunst — Mon, 20 Nov 2017 20:47:04 GMT

I would recommend you escalate with the TAC.

Make sure you are on the latest patch as well.

You maybe using a certificate that the apple ios device doesn’t like.

Out of curiosity what vendors well know cert are you using? I assume you are using a well known cert?

Re: ISE 2.2P4 Apple iPhone7 vers 11 BYOD will not Register

Jason Kunst — Mon, 20 Nov 2017 20:52:28 GMT

Have you also tried using the internal CA on ISE and not using an external PKI? You will have better results using the default settings

Re: ISE 2.2P4 Apple iPhone7 vers 11 BYOD will not Register

aprildanos — Mon, 20 Nov 2017 21:00:22 GMT

I did try using the internal ISE CA. That was my second choice. First Microsoft and then ISE by itself. Not well-known signed certificate. I am on the latest ISE patch.

Per TAC engineer, ISE BYOD and Apple are not supported when ISE provides SCEP services. Their recommendation, and only way to get it working, is have my internal Microsoft CA be the SCEP server. This is because Apple supports 3 cert chain or less. ISE adds 4 certs when being Root authority and 5 certs when acting as an Intermediate. Per TAC, apple does not like that.

Curious thing is the certificate profile was accepted once. But don't remember what happened to make that happen.

Looking for help from the community as I do not want to set up my AD server as a SCEP server but seem to have no choice.

Re: ISE 2.2P4 Apple iPhone7 vers 11 BYOD will not Register

Jason Kunst — Mon, 20 Nov 2017 21:16:29 GMT

You need to escalate to the TAC duty manager this is incorrect. ISE internal CA with apple BYOD are most definitely supported. We have this running in all our demos as well.

I would suggest you deploy a well-known certificate, otherwise you’re onboarding of apple devices will not flow correctly.

Recommend checking out this demo as well where you can see a working setup in action. You can login with your CCO ID to a working ISE setup. If you have an AP you can even connect to the setup and try it out.

https://dcloud2-rtp.cisco.com/content/demo/363207?returnPathTitleKey=favourites-view

there is only 3 certs in the chain with internal CA setup

Admin node is the ROOT

Policy services is Node-ca (signed by root)

Policy services is the sub-ca (signed by sub-ca)

Re: ISE 2.2P4 Apple iPhone7 vers 11 BYOD will not Register

aprildanos — Mon, 20 Nov 2017 21:39:07 GMT

The TAC came back and said I should not use internal ISE CA or an intermediate cert. Instead I should just use the internal cert that handles the ISE management, dot1x and portal functions. When I did that I was able to register my apple device. They provided a workable solution. I'm good for now.

Re: ISE 2.2P4 Apple iPhone7 vers 11 BYOD will not Register

Jason Kunst — Mon, 20 Nov 2017 21:51:17 GMT

Ok glad you have it running. Keep in mind you will need to deploy a well known cert in your setup for it to scale and work in production.

ISE with its internal CA for BYOD is the recommended way for deploying in production.

There might be some semantic issues going on here as well.