topic Re: Guest broken after BYOD in Network Access Control

Guest broken after BYOD

tisnow — Wed, 11 Jan 2017 08:12:09 GMT

After testing some BYOD options, I was toying around with the guest services deployments.

I've removed all profiles/certs from the endpoint, removed the client from the BYOD Registered device, however, when the client tries to log in after being sponsor approved, this message is displayed

"Endpoint is already registered to another user"

I've disabled the "automatically register devices" and that stops the automatic error message, but now clients are not put into the "GuestEndpoints" group. So they are forced to click "enable registration" to get them into that GuestEndpoints group which I use to denote that a client has registered.

Once they click "register device" they see the error ""Endpoint is already registered to another user"

So i'm stuck either way.

Ipad, Iphone and Android tested on ISE 2.1 patch 1

Re: Guest broken after BYOD

Jason Kunst — Wed, 11 Jan 2017 12:55:25 GMT

Its a guest device so it wouldn't be known when first coming in and certainly wouldn't be going through byod

Did you delete the endpoint from ise?

Re: Guest broken after BYOD

tisnow — Wed, 11 Jan 2017 14:28:14 GMT

"After testing some BYOD options, I was toying around with the guest services deployments."

The client was used for BYOD testing, then we wanted to test some guest options.

I removed it as a registered device group, but when the guest system is set to "automatically register devices" it throws the error about the system. I can indeed add the system MAC manually as a GuestEndpoint and then my guest flow works but my question is if i've hit a bug or why a pre-registered BYOD system, once removed from the Registered Devices is not able to be a guest.

Do we expect that we may never see a previously registered (then removed) BYOD device become a guest?

Re: Guest broken after BYOD

Jason Kunst — Wed, 11 Jan 2017 14:38:37 GMT

I understand what you were doing, my only point is that it's still in the endpoint database even though you removed it from the byod group, Did you delete the endpoint completely from ise?

I agree It could happen that a byod device later goes through guest but think the use case is rare

Re: Guest broken after BYOD

tisnow — Wed, 11 Jan 2017 14:58:07 GMT

Can you advise how to remove it "completely" from ise?

I made the assumption removing it from the RegisteredEndpoints would allow it to be registered.

What happens if I have a registered device, that employee leaves and it was provided to someone else to use as a Corporate Device that is registered?

Re: Guest broken after BYOD

Jason Kunst — Wed, 11 Jan 2017 15:06:49 GMT

In ISE 2.2 and perhaps 2.1 Context Visibility > Endpoints

Other releases

Administration > Identities > Endpoints

For your use case perhaps they have to handle how to transfer assets as it wouldn’t be registered to the correct person any longer

Re: Guest broken after BYOD

tisnow — Wed, 11 Jan 2017 15:24:44 GMT

"Administration > Identities > Endpoints"

This purges the system from the Database whereas removing from the RegisteredDevices does not?

Is there any other options I need to look at as I'll have time in the morning to test this out.

Thanks Jason.

Re: Guest broken after BYOD

Jason Kunst — Wed, 11 Jan 2017 15:48:13 GMT

Correct, that should be it, make sure you remove the profiles from the endpoint, forget any SSIDs, turn off the wirlesss, clear the wireless session and then delete the endpoint from the database, that would be a clean guest endpoint coming in

Remove from registered devices just removes it from the group not from ISE database.

Re: Guest broken after BYOD

tisnow — Thu, 12 Jan 2017 03:23:29 GMT

Confirmed the following

Deleting from the group as RegisteredDevices doesn't fix the problem

Deleting from Context>Endpoint does indeed solve the problem

Thanks Jason

Re: Guest broken after BYOD

TM13 — Tue, 27 Mar 2018 00:18:17 GMT

Hi Jason,

So one device cannot be used on both BYOD and Corp wireless networks?

Re: Guest broken after BYOD

Jason Kunst — Tue, 27 Mar 2018 01:57:48 GMT

Please open a new thread and explain your use case needs