topic Re: Issue with BYOD Cert install on Android in Network Access Control

Issue with BYOD Cert install on Android

nkingsbury — Mon, 30 Oct 2017 17:08:03 GMT

Hello,

I have been tasked with implementing a CWA with BYOD. Everything is almost working as expected except for BYOD on Android. I can connect and initiate the BYOD portal on the device, but when I get to the last section to download the Cisco Network Setup Assistant I have issues. I have opened up access to play.google.com, but when I click to download the tool, it spins for a few seconds than just connects me to the network. When I looked at registered devices, it shows my phone connected with no certificate.

My ISE Version is 2.3. My Native Supplicant Profile has the guest SSID selected and is set to use a certificate template issued by the internal CA. No proxy is configured.

That resource is then the result of the Client Provisioning Policy rule set.

which is then called in the policy set for any devices running the Android OS.

So, I am just trying to figure out why the CNSA is not installing and applying the cert to the device.

Re: Issue with BYOD Cert install on Android

ldanny — Thu, 02 Nov 2017 18:07:19 GMT

You may be missing DNS entries please see link below for guidance.

Using DNS-Based ACL for Chromebooks and Android Devices Using DNS-Based ACL for Chromebooks and Android Devices Using DNS-Based ACL for Chromebooks and Android Devices

Danny

Re: Issue with BYOD Cert install on Android

nkingsbury — Fri, 03 Nov 2017 18:31:38 GMT

Thanks for the reply Danny. I just got off the phone with TAC and they had the same answer. With google being so dynamic the only real solution is to keep up with all of their DNS entries.

Re: Issue with BYOD Cert install on Android

Jason Kunst — Fri, 03 Nov 2017 18:36:20 GMT

that doesn't explain why you're just being granted access, that's another issue like an incorrect policy or default setting, what did they have to say about that?

If you want to make it simple you can just allow all internet and only redirect on internal sites.

Or ask the user to download the app before they try to onboard.