BOYD with IOS

[Saeed Abd Elhalim Hamada]

Dear all , 

i have problem with BOYD with IOS 

i implement BYOD with Dual SSID  with mscap not tls (customer need 😁)and in the authiz policy i put condition the endpoint must be in the group called registered device .

the problem is when the user try to reg for the guest SSID he regi with mac address than when he redirect to the new SSID he use another mac address that not reg .. i  solve this problem by edit the setting of the phone to use off in the mac address ..

is there any another solution i can make from ISE side ?

[Greg Gibbs]

https://community.cisco.com/t5/security-knowledge-base/random-mac-address-how-to-deal-with-it-using-ise/ta-p/4049321

[Ambuj M]

I know your mac randomization is answered but on a separate note, won't recommend doing BYOD, it's not as smooth as it used to be because of all added security, I did it recently for a customer and users had to go through about 20 clicks before they are issued a cert and can connect, back in the day it use to be about 6 clicks. 

[ahollifield]

Exactly this ^ Never attempt BYOD in 2026. OS vendors have (correctly) implemented security controls that essentially make BYOD on modern endpoints a non-starter. Use an MDM instead.