topic Re: BYOD - Android Onboarding Issues in Network Access Control

BYOD - Android Onboarding Issues

rchockeelopez — Fri, 17 Feb 2017 23:04:51 GMT

Hi,

We got issues with some Android phones that is disconnecting the Wifi connection during the BYOD process when you try to navigate to Google Play.

Hope you can help.

Regards.

Re: BYOD - Android Onboarding Issues

howon — Fri, 17 Feb 2017 23:17:23 GMT

Can you provide device information and Android OS version? Also the version and patch of ISE as well. Thank you.

Re: BYOD - Android Onboarding Issues

hslai — Sun, 19 Feb 2017 01:21:12 GMT

In my experience, WLC will drop the client session, if the ACL is not allowing to go to Google play store or to download the app via Google content delivery network . I would suggest either (1) pre-download and pre-install Cisco NSA app using another WLAN or connection or (2) update the ACL.

Re: BYOD - Android Onboarding Issues

ldanny — Sun, 19 Feb 2017 08:42:29 GMT

take a look at this post for full ACEs and DNS ACL requirements.

https://communities.cisco.com/thread/62901

Note:

flexconnect mode does not support URL ACLs

wlc version 8.2+ will allow up to 20 DNS ACLs , eariler versions are limited to 10.

Re: BYOD - Android Onboarding Issues

Jason Kunst — Sun, 19 Feb 2017 09:21:09 GMT

Keep in mind if doing peap to eap-tls single ssid on boarding you can always allow internet but require on boarding once they try to access internal access

then no acl issues

Re: BYOD - Android Onboarding Issues

rchockeelopez — Mon, 20 Feb 2017 04:17:27 GMT

Hi Jason, i got single ssid on boarding. Can you explain more your point? I did not understand what you try to explain...

Re: BYOD - Android Onboarding Issues

Jason Kunst — Mon, 20 Feb 2017 08:41:22 GMT

instead of redirecting everything to ISE instead only redirect internal websites. Allow all the internet sites

They connect with PEAP and are able to access internet (allows them access to app store as well)

When they want to get access to internal resources they are redirected by the REDIRECT ACL to ISE and are required to onboard.

This way don't have to deal with DNS based ACLs, cloud based services, etc since the whole internet is allowed and they can easily use the app store

Re: BYOD - Android Onboarding Issues

rchockeelopez — Mon, 20 Feb 2017 21:59:56 GMT

I have issues with Android 5.1 and 6.0. ISE has 2.1 and patch 3.

Regards.