Byod is not working in MAC OSX HighSierra 10.13.2

[Patrick Moubarak]

I am running into an issue with ISE 2.2 patch 4 running the latest SPW for MAC OS X with the latest HighSierra update 10.13.2. BYOD flow does not work, it fails inside the Cisco Network Setup Assistant at the early step of downloading profiles. It shows 2 popups for ISE certificate to be trusted then fails to actually import them into the certificate store.

anybody experiencing the same issue?

[Francesco Molino]

Hi

I tested it with patch 5 and seems to work.
Can you apply this patch and let us know.
The only customer that has mac has been migrated to ise 2.3 recently but they were in version 2.2 patch 5 and was working well. Didn't get any complain.

[Patrick Moubarak]

Thanks Francesco, we are looking into patching but it doesn't seem like a known issue listed on bug toolkit or in the release notes.

I am wondering if it is caused by the ISE admin and EAP certificates being generated by an internal CA instead of public. I know iOS 10.3.+ does not like that and requires an extra step to trust the certificate manually during onboarding, maybe MAC OS is even stricter now.

Patrick

[Francesco Molino]

I had this issue at the beginning with Beta High Sierra OSx and there was a bug ID opened for that. Don't recall if this bug id is still visible and/or added into Patch 5 release note.

[Patrick Moubarak · Accepted solution]

Yeah I saw that bug.

I just found a workaround. Since I am using a private (internal) certificate for ISE admin and EAP, it has to be trusted in the MAC trust store manually before continuing the BYOD onboarding process, same behavior as iOS 10.3+ documented in bug CSCvd38467

Cisco recommends using public certificates for BYOD, now I know why!

Patrick

[Francesco Molino]

Yes you're right i forgot to ask about certificates and i thought it was a trusted certificate.