BYOD fails on Android 5.x and 6.x version

[Neelesh Marathe]

Hello Team,

I am working with one of the customers where we are implementing BYOD (Dual SSID) using internal CA. BYOD is working for Apple IOS, windows workstation and Andorid 4.x versions. BYOD is failing for Android version 5.x on-wards. We are getting following error when we start the NSA.

"Unable to download profile.(have you logged into guest portal?). Customer is using ISE 1.3 with patch 5.

Thanks,

Neelesh Marathe

[hslai]

It seems likely the Cisco supported OS not updated from ISE posture feed. Please try updating that.

If that does not help, post-sale, and not done already, try engaging TAC. For pre-sales and unable to engage TAC, then re-post this internally to include ISE debug logs, etc.

[Neelesh Marathe]

Hello,

Customer only have base and plus licenses. Posture update option is not present in ISE. Are you referring to profiling feed update?

Thanks,

Neelesh Marathe

[Jason Kunst · Accepted solution]

there are tac cases open on this, i searched internally and found CSCur73177 please work with tac and get attached to this as its not yet in a patch, TAC can provide temp license to resolve

[hslai]

No, not the ISE Profiling feed. ISE Profiling feed is to update ISE endpoint OUI data and and profiling policies.

One thing in ISE Posture Updates do is the "Cisco supported OS version" that also influences ISE client provisioning and NSP.

As Jason mentioned, to workaround the bug is to import a temporary APEX license. If you are a Cisco person, then you may get it yourself. Otherwise, engage TAC or ask the Cisco account team to help. You may find the link at ISE community front page.

[Neelesh Marathe]

Hello Jason/Hsing,

I applied Apex license, updated the posture database and it worked for Android 5.x and 6.x version. Thank you very much for your prompt support

Thanks,

Neelesh Marathe