BYOD - Android Onboarding Issues

[rchockeelopez]

Hi,

We got issues with some Android phones that is disconnecting the Wifi connection during the BYOD process when you try to navigate to Google Play.

Hope you can help.

Regards.

[howon]

Can you provide device information and Android OS version? Also the version and patch of ISE as well. Thank you.

[rchockeelopez]

I have issues with Android 5.1 and 6.0. ISE has 2.1 and patch 3.

Regards.

[hslai · Accepted solution]

In my experience, WLC will drop the client session, if the ACL is not allowing to go to Google play store or to download the app via Google content delivery network . I would suggest either (1) pre-download and pre-install Cisco NSA app using another WLAN or connection or (2) update the ACL.

[ldanny]

take a look at this post for full ACEs and DNS ACL requirements.

https://communities.cisco.com/thread/62901

Note:

flexconnect mode does not support URL ACLs

wlc version 8.2+ will allow up to  20 DNS ACLs , eariler versions are limited to 10.

[Jason Kunst]

Keep in mind if doing peap to eap-tls single ssid on boarding you can always allow internet but require on boarding once they try to access internal access

then no acl issues

[rchockeelopez]

Hi Jason, i got single ssid on boarding. Can you explain more your point? I did not understand what you try to explain...

[Jason Kunst]

instead of redirecting everything to ISE instead only redirect internal websites. Allow all the internet sites

They connect with PEAP and are able to access internet (allows them access to app store as well)

When they want to get access to internal resources they are redirected by the REDIRECT ACL to ISE and are required to onboard.

This way don't have to deal with DNS based ACLs, cloud based services, etc since the whole internet is allowed and they can easily use the app store