Network password prompt appear on Android 6.x/7.x after upgrade of ISE from 2.1 to 2.3

[vinmangal]

Hi Cisco exper team,

After upgrading ISE Cluster infra from 2.1 to 2.3, We are getting this additional password prompt as "Network  password" on Android phones while trying to register our Android smart phone 6.x/7.x and on above version phones

Please advise on following

• Is it some additional security policy (for which  TCP Port 8084 needs to be open between user phone subnet to ISE-PSN).?
• Is there a way this additional password prompt can be removed
• Is there any other type of phones which could be affected after upgrading of ISE from 2.1 to 2.3
• What changes we need to do in Authorization and authentication policy for continue support on apple i phones, Android smart phones

Thanks...!

[hslai · Accepted solution]

This is due to Cisco Network Setup Assistant for Android employing RFC 7030 - Enrollment over Secure Trans... 

directly with ISE 2.2+

---

• Is it some additional security policy (for which  TCP Port 8084 needs to be open between user phone subnet to ISE-PSN).?

Yes, permitting TCP 8084 to PSN. See CSCvf77241

• Is there a way this additional password prompt can be removed

 Not an option at present.

This change is due to
• Is there any other type of phones which could be affected after upgrading of ISE from 2.1 to 2.3

As you mentioned, Android 6+. 

• What changes we need to do in Authorization and authentication policy for continue support on apple i phones, Android smart phones

---

See 

• ISE 2.2 Android Provisioning with EST Authentication (Certificate Generation Failed) - YouTube
• Android BYOD Provisioning Error "Certificate Generation Fail...

[Jason Kunst · Accepted solution]

I believe this is also related?

https://community.cisco.com/t5/security-documents/android-byod-provisioning-error-quot-certificate-generation/ta-p/3733734/message-revision/3733734%3A2