ISE BYoD Policy Set Conditions

[Scott Gillies]

Hi, I have a test BYoD service that performs on-boarding with certificate and an EAPTLS journey for the client.

A colleague created the ISE BYoD Policy Set with conditions

Radius:NAS-IP-Address equals <WLC IP Address> or

Radius:NAS-IP-Address equals 127.0.0.1

He can't remember why but he needed to include the line

Radius:NAS-IP-Address equals 127.0.0.1

I have searched high and low but cannot find any Cisco documentation that explains the need for the 127.0.0.1 local host address. Does anyone know the reason for including the localhost address?

Thanks in advance

Scott

[Arne Bier · Accepted solution]

Looks bizarre. It's certainly not the norm.  I don't see how that 127.0.0.1 would be routeable to the ISE PSN node.

Have you removed that condition to see whether it's actually required?

[Jason Kunst]

Doesn’t make sense to me either. Not needed

[howon · Accepted solution]

It is required for onboarding flow that utilizes EST, which is specific to Android devices version 6+ ATM. It is a EST server that lives locally on each PSN node thus the local loopback address. It is noted as "ISE_EST_Local_Host" in the following document which is essentially the same thing as saying "request from localhost". EST flow requires server to authenticate the client and forcing the user to provide credential and validating is how EST server validates the EST request is from authenticated source.

https://community.cisco.com/t5/security-documents/android-byod-provisioning-error-quot-certificate-generation/ta-p/3733734/message-revision/3733734:2

[Scott Gillies]

Thank you so much.

He was using the 127.0.0.1 IP Address instead of the 'localhost' element to keep it consistent with the other NAS entry. :)
Both work. Excellent.