cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Announcements
Choose one of the topics below to view our ISE Resources to help you on your journey with ISE

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

1016
Views
0
Helpful
2
Replies
Highlighted
Beginner

ISE Profiler with IOS X Causing Constant CoA Reauth's

I have discovered the following profiling issue in regards to the frequent WiFi disconnects and reauths that has been plaguing our environment since July 2016.   The root cause appears to be the ISE profiler is changing Identity Group profiles constantly based on user-agent attribute matching in the Profile Policies.  This became an issue when IOS 10 and some late versions of IOS 9 started including “like Mac OS X” statements that are picked up in the User-Agent Attributes when a browser is launched.   This introduced the ability for Apple mobile devices like iPhones and iPads to match profile OS_X-Workstation and forces an CoA event to reauth.  This really gets out of hand when the user launches another App like the App Store that changes the User-Agent attributes to match back to Apple-iPhone profile causing another CoA reauth.  This can easily toggle back and forward, creating havoc on reauth’s as I have recreated in my testing. 

Example:

I connect an iPhone to WiFi and it profiles as Identity Group Apple-iPhone based on the following Profile Policies

AttributeValue
Attribute:User-Agent value:iPhone8,2/10.0.2 (14A456)

Identity GroupCertainity FactorRule
Apple-Device

10

MAC:OUI CONTAINS Apple
Apple-iPhone20IP:User-Agent CONTAINS iPhone
Total

30

I then launch browser on the iPhone and the Identity Group changes to OS_X-Workstation  based on the following Profile Policies forcing CoA event Reauth.


AttributeValue
Attribute:User-Agentvalue:Mozilla/5.0 (iPhone\; CPU iPhone OS 10_0_2 like Mac OS X) AppleWebKit/602.1.50 (KHTML, like Gecko) Version/10.0 Mobile/14A456 Safari/602.1


Identity GroupCertainity FactorRule
Workstation20IP:User-Agent CONTAINS Mac OS X
Macintosh-Workstation10IP:User-Agent CONTAINS Mac
OS_X-Workstation20IP:User-Agent CONTAINS Mac OS X
Total50

If I launch the App-Store on the iPhone, the Identity Group changes back to Apple-iPhone based on the following Profile Policies forcing CoA event Reauth.

AttributeValue
Attribute:User-Agentvalue:AppStore/2.0 iOS/10.0.2 model/iPhone8,2 hwp/s8000 build/14A456 (6\; dt:121)


Identity GroupCertainity FactorRule
Apple-Device10MAC:OUI CONTAINS Apple
Apple-iPhone20IP:User-Agent CONTAINS iPhone
Total30



The only resolution I have found was to modify the Profile Policies to either:

  • Increase Certainty value of an iPhone matching rule to supersede that of the OS_X-Workstation.
  • Create additional unambiguous rules to match like (User-Agent CONTAINS Mobile) to supersede the OS_X-Workstation profile.

I believe it would benefit to match Profile Rules based on other devices attributes that are more reliable than the User-Agent attributes that can change and be unpredictable.   Here are some of the other User-Agent values I get for iPhone and iPad.

iPhone User-Agent:

value:Mozilla/5.0 (iPhone\; CPU iPhone OS 10_0_2 like Mac OS X) AppleWebKit/602.1.50 (KHTML, like Gecko) Version/10.0 Mobile/14A456 Safari/602.1

value:AppStore/2.0 iOS/10.0.2 model/iPhone8,2 hwp/s8000 build/14A456 (6\; dt:121)

value:server-bag [iPhone OS,10.0.2,14A456,iPhone8,2]

value:iPhone8,2/10.0.2 (14A456)

value:AppleNewsWidget/608.0.1 Version/1.0.1

iPad User-Agent:

value:AppleCoreMedia/1.0.0.13G36 (iPad\; U\; CPU OS 9_3_5 like Mac OS X\; en_us)

value:Mozilla/5.0 (iPad\; CPU OS 9_3_5 like Mac OS X) AppleWebKit/601.1.46 (KHTML, like Gecko) Mobile/13G36

Thanks,

Ricky Gomez

2 REPLIES 2
Highlighted
Cisco Employee

A known defect -- CSCvb52519    iPhones being profiled as OS X Workstations

Please try updating profiler policies to the latest via online updates, which is down currently, or, in case of ISE 2.1, via offline updates. If that does not resolve it for you, please open a TAC case.

Highlighted

Thank you hslai for the reply.  I was made aware of the bug mentioned above, however this did not fix the issue.  It was suggested to turned off the Profiler Feed Services and revert back last update.  That had no affect on the issue of devices profiling incorrectly.  I have re-enabled the Feed Services and getting the latest updates but still no change to status. The only way to avoid the iPhone from profiling incorrectly is creating custom profiler match rules that supersede the certainty value of the OS X Workstation rule.

This has improved the incorrect profiling issue. However, there are still re-authentication requests occurring randomly with the termination cause of "Admin Reset".  I have been working exclusively with TAC to determine cause of these Admin Reset's from debugs, but have not found a defined cause.