Does iPhone support Cisco NAC v4.7.2 and above?

[Ramraj Sivagnanam Sivajanam]

Hi There

I have Cisco NAC enabled in my environment. It's all working fine with Windows O/S, MAC O/S and Linux O/S? I was just wondering, is Cisco NAC supported on IPhones example in in-band mode using web agent?

Regards,

Ram

+6012-2918870

[Ramraj Sivagnanam Sivajanam]

Hi There

In Cisco's website, it states that the Cisco NAC Appliance recognizes IPhone iOS as "Macintosh All" and supports basic web login only if Safari browser is used. Cisco has released a patch update for Cisco NAC Appliance Release 4.7(2) CASs that provides web login (no persistent or temporal Agents) support for Apple iPads. See caveat CSCtf60530.

I tried it myself earlier today, and it doesn't work? Is there any additional steps required for this?

Regards,

ram

+6-0122918870

[Ramraj Sivagnanam Sivajanam]

Hi Everyone

Yes, Cisco NAC do support IPhone IOS, but you'll need to install JAVA, which cannot happen unless you jailbreak the IPhone. How do you recommend your clients to jailbreak their IPhone. That's illegal in many countries. Hence, when Cisco say Cisco NAC do support IPhone IOS, they also need to mention about JAILBREAK as well :-(

[Lauren Sullivan]

Hi Ramraj,

It sounds like the user page is configured incorrectly - under the general tab for the MAC_ALL page, please make sure the "use web client" options are not checked.  After that, the client should not be required to use Java to login.

Thanks,

Lauren

[Ramraj Sivagnanam Sivajanam]

Hi Lauren Sullivan

I don't have that option checked, as shown below

Device Management > Clean Access

Certified Devices		General Setup		Network Scanner		Clean Access Agent		Updates
Web Login   ·  Agent Login
User Role	Unauthenticated Role(not common) Int_Adm_CICT Programmer_SA_CICT Canselori Daftar Bendahari Int_Adm_CICT_HRFinD Int_Adm_CICT_Latih Int_Adm_CICT_BSP HEP SPS FKE_Lect FKE_Stud FKE_Admin FKE_DK Pejabat_Harta_Bina PSZ_Stud PSZ_Stud_NB PSZ_ADM FSKSM_Lect FSKSM_StudLevel5A FSKSM_StudLevel5B FSKSM_StudLevelPG FSKSM_StudLevelGMM FSKSM_StudLevelSE FSKSM_StudLevelICM FSKSM_StudLevelIS FSKSM_StudLevelCSC FSKSM_StudLevelSS PPIPS FAB_Admin FKA_Admin FAB_Lect FAB_Stud FKSG_Lect FKSG_Stud FKSG_Admin FP_Lect FP_Stud FP_Admin FPPSM_Lect FPPSM_Admin FPPSM_Stud FKM_Admin FKM_Marine FKM_WLAN FKM_Stud FKA_U_Grad FKA_P_Grad FKA_COE FKA_WLAN BIP_Admin BIP_Tenan BIP_WLAN BIP_CADD BIP_DewanKuliah FS_Physics FS_Math FS_Kimia FS_Stud FS_Staff FS_Diskless FS_Admin FS_Server FS_Quarantine FS_WLAN FKKKSA_Acad40 FKKKSA_Acad41 FKKKSA_Acad42 FKKKSA_Acad43 FKKKSA_Acad44 FKKKSA_Acad46 FKKKSA_Acad47 FKKKSA_Acad45 FKKKSA_Admin FS_AIMS FKKKSA_CEPP
Operating System	ALL WINDOWS_ALL WINDOWS_2K WINDOWS_XP WINDOWS_VISTA_ALL WINDOWS_7_ALL MAC_ALL MAC_OSX LINUX FREEBSD SOLARIS_ALL SOLARIS_86 SOLARIS_SPARC UNIX VMS OS2 PALM
Use 'ALL' settings for the MAC OS family if no version-specific settings are specified

---

   Show Network Scanner User Agreement page to web login users
  Enable pop-up scan vulnerability reports from User Agreement page
  Require users to be certified at every login
  Exempt certified devices from web login requirement by adding to MAC filters
  Block/Quarantine users with vulnerabilities in role: Quarantine Role  (20 minutes) -- Block Access --

Show quarantined users User Agreement Page of:

original role (deprecated) quarantine role -- None --

        Message (or URL) for Blocked Access Page:
        <b>Network Security Notice:</b> There are vulnerabilities found on your machine.<br>You are not allowed to access the network before fixing them.
            

[Lauren Sullivan]

Hi Ramraj,

That's the settings for the web agent, not the web client - annoyingly similar names, but totally different things

For the web client, it's under Adminstration > User Pages > edit the page for MAC_ALL, and it's under the General tab.

Thanks,

Lauren

[Ramraj Sivagnanam Sivajanam]

Hi Lauren Sullivan

Thank you for your prompt and kind assistance. Shown below are my present settings under Administration > User Pages > EDIT > General

Use web client to detect client MAC address and Operating System.

Use web client to release and renew IP address when necessary (OOB). (Helps OOB client acquire new IP address after authentication without bouncing the switch port)

Install DHCP Refresh tool into Linux/MacOS system directory. (Avoids root/admin password prompt to refresh the IP address for Linux/MacOS clients when the web client is used to perform DHCP release and renew)

Hence, do I uncheck the first item only?

[Ramraj Sivagnanam Sivajanam]

Hi Lauren Sullivan

I have disable all the 3 options listed below and it's slightly better now, but when it prompts me to download the Cisco NAC agent, I get an error, "Safari cannot download the file". I believe this could be because my iPhone has not been jailbreak yet, hence I can't download? Conclusion, can I say, if you don't jailbreak your iPhone, this means iPhone cannot be used with Cisco NAC?

Use web client to detect client MAC address and Operating System.

Use web client to release and renew IP address when necessary (OOB). (Helps OOB client acquire new IP address after authentication without bouncing the switch port)

Install DHCP Refresh tool into Linux/MacOS system directory. (Avoids root/admin password prompt to refresh the IP address for Linux/MacOS clients when the web client is used to perform DHCP release and renew)

[Lauren Sullivan]

Hi Ramraj,

Ah - let me clarify a bit more.  You can do web authentication (no posture assessment) with iPhones (or most other mobile devices), but can't install the NAC agent or NAC web agent.

Are you able to see the user page on the iPhone now and authenticate, and then getting that agent prompt?  If so, it sounds like you have the agent required for all OSs for that user role.  So, under Clean Access > General Setup > Agent login, choose the user role, and then choose MAC_ALL as the OS.  You'll want to uncheck "use ALL settings for the Mac OS X family" and then make sure "require use of agent" and "require use of Cisco NAC web agent" are both unchecked.  If you are using the Mac agent for your OS X users, please make sure to then set the OS to MAC_OSX and check "require use of agent" there.

Thanks,

Lauren

[Ramraj Sivagnanam Sivajanam]

Hi Lauren Sullivan

Yes, I have uncheck "use ALL settings for the Mac OS X family" and then make sure "require use of agent" and "require use of Cisco NAC web agent" are both unchecked.

Currently, when I use my iPhone to login into the NAC, i still see the page asking me to download the agent. WHen I click on the continue button, it hangs there. This behaviour is similar to Windows based Mobile Phones as well. What should I do? Please kindly advice.

Yes, I do have MAC OS workstations in my network. I do have the Use 'MAC_ALL' settings for this OS version set for this, as shown below? Perhaps, I should change set the OS to MAC_OSX and check "require use of agent" ONLY.

Certified Devices		General Setup		Network Scanner		Clean Access Agent		Updates
Web Login   ·  Agent Login
User Role	Unauthenticated Role(not common) Int_Adm_CICT Programmer_SA_CICT Canselori Daftar Bendahari Int_Adm_CICT_HRFinD Int_Adm_CICT_Latih Int_Adm_CICT_BSP HEP SPS FKE_Lect FKE_Stud FKE_Admin FKE_DK Pejabat_Harta_Bina PSZ_Stud PSZ_Stud_NB PSZ_ADM FSKSM_Lect FSKSM_StudLevel5A FSKSM_StudLevel5B FSKSM_StudLevelPG FSKSM_StudLevelGMM FSKSM_StudLevelSE FSKSM_StudLevelICM FSKSM_StudLevelIS FSKSM_StudLevelCSC FSKSM_StudLevelSS PPIPS FAB_Admin FKA_Admin FAB_Lect FAB_Stud FKSG_Lect FKSG_Stud FKSG_Admin FP_Lect FP_Stud FP_Admin FPPSM_Lect FPPSM_Admin FPPSM_Stud FKM_Admin FKM_Marine FKM_WLAN FKM_Stud FKA_U_Grad FKA_P_Grad FKA_COE FKA_WLAN BIP_Admin BIP_Tenan BIP_WLAN BIP_CADD BIP_DewanKuliah FS_Physics FS_Math FS_Kimia FS_Stud FS_Staff FS_Diskless FS_Admin FS_Server FS_Quarantine FS_WLAN FKKKSA_Acad40 FKKKSA_Acad41 FKKKSA_Acad42 FKKKSA_Acad43 FKKKSA_Acad44 FKKKSA_Acad46 FKKKSA_Acad47 FKKKSA_Acad45 FKKKSA_Admin FS_AIMS FKKKSA_CEPP
Operating System	ALL WINDOWS_ALL WINDOWS_2K WINDOWS_XP WINDOWS_VISTA_ALL WINDOWS_7_ALL MAC_ALL MAC_OSX LINUX FREEBSD SOLARIS_ALL SOLARIS_86 SOLARIS_SPARC UNIX VMS OS2 PALM
Use 'MAC_ALL' settings for this OS version

---

   Require use of Agent (for Windows & Macintosh OSX only)
        Agent Download Page Message (or URL):
        <b>Network Security Notice:</b> This network is protected by a Cisco NAC Appliance Agent, a component of the Cisco NAC Appliance Suite. The Agent ensures that your computer meets the requirements for accessing this network, and helps you keep your computer secure and up-to-date. <p>Please use the Agent to log in to the network. <p>If you don't have the Agent software yet, download it by clicking the button below. After downloading the installation file, run it to complete the installation. <p>If you have already downloaded and installed the Agent, please close this window and right-click the Agent icon in the system tray and choose Login from the menu. Enter your usual network user name and password in the login window.
  Require use of Cisco NAC Web Agent (for Windows 7/2000/XP/Vista only)
        Cisco NAC Web Agent Launch Page Message (or URL):
        <b>Network Security Notice:</b> This network is protected by the Cisco NAC Web Agent, a component of the Cisco NAC Appliance Suite. The Cisco NAC Web Agent ensures that your computer meets the requirements for accessing this network, and helps you keep your computer secure and up-to-date. <p>Please launch Cisco NAC Web Agent by clicking the button below.
  Allow restricted network access in case user cannot use NAC Agent or Cisco NAC Web Agent