topic Re: ISE 2.2 and Meraki Deployment - CNA Apple Issues in Network Access Control

ISE 2.2 and Meraki Deployment - CNA Apple Issues

creviscrevis — Tue, 29 Aug 2017 11:32:09 GMT

Hi folks,

We have some issues with CNA Apple in ISE 2.2 and Meraki deployment . I read that is supported in this ISE version, but didn´t working. To access guest redirection page i need open the browser manually , Another import information is that with Android devices working good.

Could you please help me ?

Re: ISE 2.2 and Meraki Deployment - CNA Apple Issues

Jason Kunst — Tue, 29 Aug 2017 12:44:05 GMT

With traditional wireless controllers we spoofed apples response so the mini browser wouldn't pop up

This was the captive portal bypass feature

To get it to pop we disabled captive portal bypass

This is not something that ise can control, ise is supported to work with the mini browser when it does display , we don't have any control over wether it pops up or not

Please work with meraki team to troubleshoot if they have a suppression capability

Re: ISE 2.2 and Meraki Deployment - CNA Apple Issues

Jason Kunst — Tue, 29 Aug 2017 12:50:29 GMT

Recommend trying a traditional splash page from meraki as well to see what happens

Re: ISE 2.2 and Meraki Deployment - CNA Apple Issues

creviscrevis — Tue, 29 Aug 2017 15:00:54 GMT

Hi Jason

I tested with Splash Page with Facebook Authentication and works fine !

tks

Re: ISE 2.2 and Meraki Deployment - CNA Apple Issues

Jason Kunst — Tue, 29 Aug 2017 15:03:18 GMT

OK I would recommend moving forward with the TAC, please let us know

Re: ISE 2.2 and Meraki Deployment - CNA Apple Issues

samye — Tue, 10 Oct 2017 14:34:15 GMT

hi Cleverson:

are there any update from you? I meet the same issue

does meraki give you answer on it?

tks a lot

Re: ISE 2.2 and Meraki Deployment - CNA Apple Issues

creviscrevis — Tue, 10 Oct 2017 14:44:14 GMT

Hi,

No , same issue is happening....

Re: ISE 2.2 and Meraki Deployment - CNA Apple Issues

samye — Wed, 11 Oct 2017 00:08:03 GMT

Tks, any information from meraki?

Re: ISE 2.2 and Meraki Deployment - CNA Apple Issues

foozed — Wed, 08 Nov 2017 12:05:11 GMT

I've been struggling with a very similar issue for months as well.

My issue is slightly different where the captive portal opens sometimes, but most of the time will open, then abruptly close, open again long enough for a web redirection, authentication, and then abruptly close again with no success or redirect with a wlan disconnect.

I've opened tickets with Meraki, and they point a finger at Cisco.

I open tickets with Cisco TAC, and they point a finger at Meraki.

I don't believe it to be an ISE issue either, but the folks at Meraki don't appear to have as well an organized TAC/troubleshooting method as Cisco do unfortunately.

I cannot get anywhere with it.. I've asked my Cisco AM multiple times to get both Meraki and Cisco on the phone together to troubleshoot to no avail.

I am no longer an Enterprise customer with Cisco so I do not have a dedicated SE.

Someone who is having this issue (who is an Enterprise customer) needs to get their SE to organize a meeting with both groups to determine with certainty where the root cause is, and what can be done to address it (if anything).

Re: ISE 2.2 and Meraki Deployment - CNA Apple Issues

Jason Kunst — Wed, 08 Nov 2017 12:18:31 GMT

If you’re using hotspot portal on ISE 2.2 make sure the option under portal setting is set to reauth and not disconnect for coa

Re: ISE 2.2 and Meraki Deployment - CNA Apple Issues

aruscheng — Tue, 12 Dec 2017 13:36:56 GMT

Hi Cleverson,

I have get the same problem like you.

With the same environment, ISE2.2, Meraki AP and customize guest portal from isepb.

Just want to know if you have solve the problem? Or anyone can help in this problem, thanks.

Re: ISE 2.2 and Meraki Deployment - CNA Apple Issues

Jason Kunst — Tue, 12 Dec 2017 13:50:34 GMT

Please reach out to the tac and let us know

Re: ISE 2.2 and Meraki Deployment - CNA Apple Issues

Richard Wakefield — Fri, 22 Jun 2018 01:42:43 GMT

I have this mocked up in my lab.

-2504 Running 8.3, MAB, AAA override and ISE NAC. I get the pop up, enter creds, and are redirected to the success page and it works fine on IOS, MACOS, Windows.

-Meraki MR32, MAB, ISE for Radius and "Use ISE for splash page". My IOS devices get the pop up, enter creds, and get a 400 Error. Works fine on Windows and MACOS.

So, I tried this:

-Meraki MR32, MAB, ISE for Radius and "Use ISE for splash page". Added 17.0.0.0/8 into the walled garden list (nslookup on apple.com), and the CNA browser did not pop up. I opened a browser manually (fail, default was https://www.google.com), went to a http (no s) site, my Splash page came up, enter creds, and logged in just fine.

Sounds like the ISE CNA is working fine since it worked great with a Cisco WLC, but whatever Meraki is doing in the middle is breaking it.

Same exact Results policy all along.

Anybody else ever get this figured out?

Seems this is a common issue:

https://community.meraki.com/t5/Wireless-LAN/Apple-CNA-didn-t-popup-in-Meraki-integrated-with-ISE/td-p/10483

https://community.meraki.com/t5/Wireless-LAN/Cisco-ISE-2-2-for-Guest-amp-BYOD-issues-with-Apple-IOS-devices/m-p/10777/highlight/false#M1811

Re: ISE 2.2 and Meraki Deployment - CNA Apple Issues

Chris Johnson — Fri, 22 Jun 2018 02:48:43 GMT

Richard,

I definitely am still dealing with having to enter http only, but since I posted in another thread about the "fix" which only makes it less frequent for us, one of my branch offices has been reporting issues even going to just http. I don't see it hardly at all in my data center. I am running MR32s here and they run MR33. What ISE version are you running?

Re: ISE 2.2 and Meraki Deployment - CNA Apple Issues

Richard Wakefield — Fri, 22 Jun 2018 02:56:02 GMT

I've got 2.3 patch 4 in my lab, and it is an MR32 not a 34 as I said above. It all works great with my Cisco WLC running 8.3 MAB/RadiusNAC/AAAOverride, but having the above described issue with the MR32 with IOS (iphone and ipad running 11.4). MACOS and Windows are both totally happy...

Re: ISE 2.2 and Meraki Deployment - CNA Apple Issues

Chris Johnson — Fri, 22 Jun 2018 03:22:01 GMT

Gotcha, we are running pretty much the same setup then. I might spin up a virtual WLC trial and get an AP to test. If things stay this way I’d be able to sell the costs for sure if it meant better user experience. I’ve only got it deployed at my DC and one other office now, but if guest wireless deployment expands quickly, the voices will be louder.

Re: ISE 2.2 and Meraki Deployment - CNA Apple Issues

Richard Wakefield — Fri, 22 Jun 2018 03:29:14 GMT

I've got something like this, ISE Captive Portal of some flavor, running with Cisco WLCs at very large deployments (100,000 users and 10,000 APs, 60,000 users also 10,000 APs, etc.) and the first time I hit this problem was when I tried to recreate the same type of Captive Portal with a Meraki MR32... Unfortunately people seem to have been having these issues for at least 8 months according to the forums and it's still not resolved. Some of the responses I saw were, "Why not just use Meraki for this instead of ISE, it does the same thing" which I categorically disagree with...

Hopefully somebody can step in and tell us, "Hey dumb guys, you forgot to check the checkbox X to make this work" and it'll fix it for us. But I'm not holding my breath.

Re: ISE 2.2 and Meraki Deployment - CNA Apple Issues

Chris Johnson — Fri, 22 Jun 2018 03:44:13 GMT

Haha. I see we think along the same lines. I completely agree with you about the people telling us “just use Meraki.” You seem to be in the same boots as me. When you hit a certain point (feature or size) Meraki just doesn’t do it the same. A Cisco SE told me a year or two ago when someone on my team asked the major difference, his response was its Cisco without all the nerd knobs. Apparently when it comes to ios with CWA, it left off the knob that makes it work. I really feel there is one small feature that needs to be turned on or off to make it more compatible, I just haven’t found it yet to ask Meraki if its there on their side and we just can’t see it yet.

Re: ISE 2.2 and Meraki Deployment - CNA Apple Issues

Jason Kunst — Fri, 22 Jun 2018 10:48:16 GMT

I don’t think the version of ISE has anything to do with it. However recommend ISE 2.2 minimum to work with Apple CNA