topic Re: ISE 2.2 Compatibility Issues in Network Access Control

ISE 2.2 Compatibility Issues

crstevens3 — Mon, 05 Jun 2017 15:48:27 GMT

This is more of an inquiry to see if others are experiencing similar issues.

I have installed ISE 2.2 from scratch for our new deployment and went live on May 1st with a Guest Hotspot portal only. I have approximately 1100 - 1300 guest users connected at any given time.

The issues are related to different mobile devices not being able to complete the AUP acceptance. It seems that random Samsung devices cannot press the "Accept" button. When they click the button, it does nothing. Random iOS devices will get an "Error HTTP 500" page after clicking the "Accept" button.

The affected devices will not work regardless of how many times they are disconnected and reconnected. It also doesn't seem to be a large number of devices, maybe 1-2% at most. It is completely random and I cannot replicate it on any of my test devices.

Has anyone else had issues like this or am I alone? I feel like I should not have started with ISE 2.2 as it is so new

Re: ISE 2.2 Compatibility Issues

Timothy Abbott — Mon, 05 Jun 2017 15:56:44 GMT

Hi Roger,

Are you able to find any commonality among the 1-2% of devices that are experiencing the issue (i.e. OS version, etc). Since is a small subset of guest devices having the problem makes me wonder if these devices are running older code or something similar. I'm also curious as to your guest setup? What wireless controller are you using and do you have captive portal bypass enabled?

Regards,

-Tim

Re: ISE 2.2 Compatibility Issues

crstevens3 — Mon, 05 Jun 2017 16:07:03 GMT

I was able to verify 2 different iOS devices, one working and one receiving the 500 error. They both had the exact same code, model, etc. I was unable to find any differences between them. Luckily that was a member of my departments phone that I was able to test with. Most of this happens to end users' personal devices that I really cannot troubleshoot with.

We are running a WiSM2 on 8.0.133.0 code. Captive Bypass is disabled as I was going to try to take advantage of the new iOS support for captive portals.

Re: ISE 2.2 Compatibility Issues

Timothy Abbott — Mon, 05 Jun 2017 16:27:14 GMT

Are you able to consistently reproduce the issue with the device getting the 500 error?

Regards,

-Tim

Re: ISE 2.2 Compatibility Issues

crstevens3 — Mon, 05 Jun 2017 16:33:10 GMT

Yes, once I find a device with the issue, it always reproduces the issue. I sent PCAPs and everything to TAC and they weren't much help.

To me, it appeared that ISE was responding correctly, but somewhere between the controller, the AP, and the client some response data was getting lost. Maybe I should go to 8.0.135.0 on the WiSM2?

I have just been whitelisting clients that have issues at this point.

Re: ISE 2.2 Compatibility Issues

Timothy Abbott — Mon, 05 Jun 2017 16:55:31 GMT

I just checked cisco.com and it showing that 8.0.140.0 is the recommended version for stability and longevity. Might be worth a try in lab to see if that works.

Regards,

-Tim

Re: ISE 2.2 Compatibility Issues

crstevens3 — Mon, 05 Jun 2017 17:35:36 GMT

Thanks for the observation! We are talking about upgrading to that soon. I think that is the highest we can go with 1131 model APs still out in the field.

Thanks for you help!