BYOD NSP failed for Windows 7, iPhone and MacBook, but Android succeeded

[dicmupha]

Hi, I'm doing a ISE POV for my customer with BYOD as one of the feature to demo. "Secure access configuration for the network failed" error was returned on the network setup assistance application (with screenshot below). I've checked on the certificate store on Windows, ISE's CA self-signed cert was pushed down but not the User Cert.

spwProfileLog file shows as below, indicating that the NSP process failed to configure the device due to certificate installation failure. However it works fine on Android mobile phone.

Appreciate if anyone can shed some light to this..

[hslai]

Your log file looks like ISE not issuing the client certificate but we won't know more until looking at the ISE debug logs with pertinent components in DEBUG. It's best for you to engage Cisco TAC to troubleshoot. Else, you may take a look at the existing ISE dCloud labs and try your clients there.

Attached is a spwProfileLog.txt from a Win-7 client successfully performed a BYOD on its wired connection (MAB -> CWA -> BYOD -> EAP-TLS).

[dicmupha · Accepted solution]

Thanks @hslai ! I managed to dig into ISE debug logs, where I found these logs and resolve the problem by replacing ISE root CA certificate chain.

2018-02-02 15:48:06,365 DEBUG  [https-jsse-nio-172.25.89.244-8443-exec-10][] cisco.cpm.provisioning.cert.CertProvisioningFactory -::::- Found incoming certifcate request for internal CA. Increasing Cert Request counter.

2018-02-02 15:48:06,368 INFO   [https-jsse-nio-172.25.89.244-8443-exec-10][] cisco.epm.pdp.cache.CacheUtil -::::- before casting object to transaction

2018-02-02 15:48:06,368 INFO   [https-jsse-nio-172.25.89.244-8443-exec-10][] cisco.epm.pdp.cache.CacheUtil -::::- object is an instance of TransactionInfo

2018-02-02 15:48:06,368 INFO   [https-jsse-nio-172.25.89.244-8443-exec-10][] cisco.epm.pdp.cache.CacheUtil -::::- after casting object to transaction inside loop 0

2018-02-02 15:48:06,368 INFO   [https-jsse-nio-172.25.89.244-8443-exec-10][] cisco.mnt.dbms.handler.DataSourceReInitializingHandler -::::- object is an instance of TransactionInfo

2018-02-02 15:48:06,379 DEBUG  [https-jsse-nio-172.25.89.244-8443-exec-10][] cisco.cpm.provisioning.cert.CertProvisioningFactory -::::- Key type is RSA, retrieving ScepCertRequestProcessor for caProfileName=ISE Internal CA

2018-02-02 15:48:06,379 DEBUG  [https-jsse-nio-172.25.89.244-8443-exec-10][] cisco.cpm.provisioning.cert.CertRequestValidator -::::- Session user has been set to = srv_isepoc

2018-02-02 15:48:06,379 WARN   [https-jsse-nio-172.25.89.244-8443-exec-10][] com.cisco.cpm.scep.ScepCertRequestProcessor -::::- No live PKI server found for certificate request [C=US,ST=State,L=City,O=Company name,OU=Example unit,CN=srv_isepoc]

[hslai]

I am glad it now working for you. Thanks a lot for the update.

[gurbinder.kabbay]

Hi Dicumpha,

How I can change the ISE root CA certificate chain.what are the steps, any documentation or customize steps you have, please share.

it I am facing same issue for wired users.

Thanks

Garry