Ever since deploying ISE 2.4 patch 9 with ASA to offer AnyConnect RAVPN services to BYOD users by checking against MDM/AirWatch for AD group membership and AirWatch device registration status we have had continuous issues with ISE reporting DeviceRegisterStatus equals false mainly for LAN connected users over the VPN. WLAN connected users over the VPN usually don't have issues. Cisco TAC wanted us to bounce the external MDM account in ISE by removing the currently defined external MDM source in ISE and then adding it again to see if ISE will utilize MDM v2 to perform queries instead of MDM v1. We want ISE to utilize UDID when making a query to AirWatch on an endpoint instead of MAC address.
Has anyone run into this issue before? I'm going to test this in the lab today and will report back my findings.
