ISE Profile iPad as OSX Catalina

[jmecklenburg]

Hi Team

I have a ISE 2.6 patch 3, and today I have a issue with a iPad version 13.2.3 I try to enrol as BYOD but the ISE profile the iPad as OSX Workstation Catalina, so the ISE offer to me the Cisco Network Setup image not the wireleess certicate proccess using in a iPhone. Then the process is incomplete. I can't run the dmg image in a iPAD.

I try static assign the iPad as Apple-iPhone but the ISE still offer to me the dmg image.

How to fix that?

Regards

[Colby LeMaire]

It is possible that the new iOS software is sending different attributes so ISE is not able to profile it correctly.  Find the endpoint under Context Visibility and go to the Attributes tab.  Go down the list of attributes that ISE learns for the device.  Specifically User-Agent.  Then go to the iPad profiling policy and see if it should match or not.  You may have to modify the profiling policy for iPad.

[Jason Kunst]

---

@Colby LeMaire wrote:

It is possible that the new iOS software is sending different attributes so ISE is not able to profile it correctly.  Find the endpoint under Context Visibility and go to the Attributes tab.  Go down the list of attributes that ISE learns for the device.  Specifically User-Agent.  Then go to the iPad profiling policy and see if it should match or not.  You may have to modify the profiling policy for iPad.

---

Correct. I have an ipad and it worked fine for me using the dual SSID (open using guest portal). If still not working open TAC case. Let us know!

[andrewswanson]

Hi

Do you have the ISE Profiler feed enabled (under Administration > Feed Service > Profiler). Cisco have made some changes affecting Catalina (my ISE deployment downloaded these on the 20th December)

The changes are:

OS_X_Catalina-Workstation-Rule1-Check1
name=OS_X_Catalina-Workstation-Rule1-Check1]\System defined: true\\Description:Condition for OS_X_Catalina-Workstation based on IP:User-Agent\User Visible:true\Type:IP\AttributeName:User-Agent\Operator:CONTAINS\AttributeValue:10.15

OS_X_Catalina-Workstation-Rule2-Check1
name=OS_X_Catalina-Workstation-Rule2-Check1]\System defined: true\\Description:Condition for OS_X-Catalina-Workstation based on IP:User-Agent\User Visible:true\Type:IP\AttributeName:User-Agent\Operator:CONTAINS\AttributeValue:10_15

If you have these updates, it may be worth re-profiling the ipad.

hth
Andy

[CarlCarlson1234 · Accepted solution]

@jmecklenburg Starting with "iPad" OS 13.  Safari requests the desktop version of websites by default.   This needs to be turned off before on-boarding and turned back on after.  On your iPad to to Settings, Safari, Request Desktop Website.  Toggle off "All Websites".

Then enroll the device normally.

[Jason Kunst · Accepted solution]

In ISE 2.6 patch 3 there is a pull down for the user to choose what device they have

http://cs.co/ise-byod
please check ISE BYOD Endpoint Notes/Issues<>

[Arne Bier]

@CarlCarlson1234  Has the correct solution. I had the exact issue with a customer recently. iPads have this on by default because their screens are so large that they can pretend to be a desktop. 

[Jason Kunst]

Yes but not valid for stupid end users.. see my solution for long term fix