topic Re: BOYD with IOS in Network Access Control

BOYD with IOS

Saeed Abd Elhalim Hamada — Thu, 29 Jan 2026 01:19:06 GMT

Dear all ,

i have problem with BOYD with IOS

i implement BYOD with Dual SSID with mscap not tls (customer need 😁)and in the authiz policy i put condition the endpoint must be in the group called registered device .

the problem is when the user try to reg for the guest SSID he regi with mac address than when he redirect to the new SSID he use another mac address that not reg .. i solve this problem by edit the setting of the phone to use off in the mac address ..

is there any another solution i can make from ISE side ?

Re: BOYD with IOS

Greg Gibbs — Thu, 29 Jan 2026 02:32:59 GMT

https://community.cisco.com/t5/security-knowledge-base/random-mac-address-how-to-deal-with-it-using-ise/ta-p/4049321

Re: BOYD with IOS

Ambuj M — Thu, 29 Jan 2026 03:41:30 GMT

I know your mac randomization is answered but on a separate note, won't recommend doing BYOD, it's not as smooth as it used to be because of all added security, I did it recently for a customer and users had to go through about 20 clicks before they are issued a cert and can connect, back in the day it use to be about 6 clicks.

Re: BOYD with IOS

ahollifield — Thu, 29 Jan 2026 16:11:06 GMT

Exactly this ^ Never attempt BYOD in 2026. OS vendors have (correctly) implemented security controls that essentially make BYOD on modern endpoints a non-starter. Use an MDM instead.