Showing results for 
Search instead for 
Did you mean: 
Cisco Employee
Cisco Employee


Please reference this table for defect info

Apple CNA (Captive Network Assistant, AKA Apple mini browser) is a Apple iOS feature that allows a browser like window to pop-up whenever network access is needed and the CNA determines that the network requires user interaction to gain full network access. This typically happens when the user associates to an open wireless LAN and even though an IP address is provided to the device, the network still restricts the user to take further actions, such as accepting an AUP, providing a shared password, or logging in as a guest user. This enhances user experience as it saves the user from manually opening up a Safari browser window. It also provides assistance even during non-initial association to the WLAN. For instance, if the endpoint device goes into sleep mode and the session is torn down on the WLC and subsequently the user tries to use a non-web browser application that requires network connectivity, the iOS device can sense that the device is in captive portal state and pop-up the mini browser for user to take further action to gain network access. As one can see having the iOS CNA feature operate on a guest network is a good idea, however, when BYOD is enabled on the same WLAN, as is the case with ISE dual-SSID flow, the CNA breaks the ISE BYOD process. One of the reason for that is due to ISE BYOD process forcing the CNA mini browser to go into the background as it asks the end user to accept the iOS profiles, which includes CA certificate and enrollment package, and when the CNA mini browser is moved to the background it immediately disconnects the device from the WLAN, which in turn breaks the BYOD process.


Prior to ISE 2.2, the ISE was setup to warn the user that the browser is not supported and user had no easy way aside from reporting it to the network administrator and subsequently the administrator had to enable captive bypass on the WLC which disabled the pop-up of the CNA mini browser on the controller level. Unfortunately, the captive bypass feature on WLC 8.3 and below required to be ran controller wide, which meant that all of the WLANs that the controller was servicing disabled the apple CNA. Cisco ISE version 2.2 is the first version to support Dual-SSID BYOD flow through Apple CNA. This document explains how to configure the ISE and Cisco WLC to provide Dual-SSID BYOD even when the captive portal bypass feature is disabled on the WLC. For other options on how to deal with Apple CNA, please go to: Dealing with Apple CNA (AKA Mini browser) for ISE BYOD


This document will leverage pre-defined policy rules and elements for dual SSID BYOD configuration. Also, this document assumes that the WLC is already configured with baseline WLC configuration for ISE. For more information on the baseline WLC ocnfiguration please refer to: How To: Universal Wireless Controller (WLC) Configuration for ISE


User experience:

  1. User associates to OPEN SSID
  2. Apple CNA mini browser pop-up
  3. User enters employee ID (ISE recognizes non guest accounts to be employee users)
  4. User is asked to wait for ‘Done’ in the upper right corner and click the link which pops up the full Safari browser to continue with BYOD process
  5. User starts BYOD flow and enters description for the device
  6. Downloads root CA certificate & enrollment profile (Certificate + WiFi settings)
  7. User is asked to connect to secure SSID
  8. User has Full network access



Cisco ISE version 2.2+

Cisco WLC 7.6+ for DNS ACL feature; not possible with FlexConnect local switching WLAN as DNS ACL is not supported for locally switched traffic

Note: If running WLC 8.4+ code then the captive portal bypass can be enabled per WLAN instead of globally. It still does not allow administrator to use a single WLAN for both CNA enabled guest access and employee BYOD, but allows them to enable captive portal bypass selectively per WLAN instead of controller wide.

Cisco Wireless Controller Configuration Guide, Release 8.4 - WLAN Security [Cisco Wireless LAN Controller Software] - …


Cisco WLC:

(Optional) Disable captive portal bypass

  1. If previously enabled, go to the CLI of the WLC and disable captive portal bypass by running 'config network web-auth captive-bypass disable'
  2. Save config
  3. Reset system for the settings to take affect


Create Additional ACL for Apple iOS devices to provide ‘Done’ on the CNA mini browser (Note: This ACL provides full network access for the endpoint temporarily during BYOD process. This is necessary to suppress Apple CNA)

  1. Go to WLC GUI and navigate to SECURITY > Access Control Lists > Access Control Lists
  2. Click 'New...' in the upper right corner
  3. Name the new ACL ' ACL_APPLE_CNA'
  4. Add Deny any IP traffic to
  5. Add Permit any IP traffic to any
  6. Example shown below

Screen Shot 2017-02-01 at 1.51.39 PM.png



Perform Posture Update (Required for ISE to recognize the OS)

  1. Go to ISE GUI and navigate to Administration > System > Settings
  2. On the left hand menu, click on Posture > Updates
  3. Click on 'Update Now' (Will take about 20 minutes to update, you can navigate away and perform rest of the steps below)


Configure Guest portal to provide BYOD for employee users

  1. Go to ISE GUI and navigate to Work Centers > Guest Access > Portals & Components
  2. Click on the 'Self-Registered Guest Portal (default)' (Or the portal that is going to be used for dual-SSID BYOD flow)
  3. Click on 'BYOD Settings' and enable 'Allow employees to use personal devices on the network' option
  4. Click 'Save'

Screen Shot 2017-02-01 at 12.47.20 PM.png


Create Additional Authorization profile to redirect any traffic that matches destination of

  1. Navigate to Policy > Results > Authorization > Authorization Profiles
  2. Click 'Add' to add a new AuthZ profile
  3. Enter 'NSP_Apple_CNA' as name
  4. Under Common Tasks section check 'Web Redirection (CWA, MDM, NSP, CPP)' and select Centralized Web Auth, enter 'ACL_APPLE_CNA' for ACL, and select 'Self-Registered Guest Portal (default)' from the list
  5. Click 'Save'

Screen Shot 2017-02-01 at 12.45.01 PM.png


Create Authorization policy rule for Apple iOS device

  1. Navigate to Policy > Authorization
  2. Insert a New Rule Above the 'Wifi_Redirect_to_Guest_Login' and create a policy rule named 'Employee_Onboarding_Apple_CNA'
  3. For the condition of the rule, select 'Add Condition from Library' and then select Compound Conditions > Wireless_MAB
  4. Add another condition using 'Add Attribute/Value' and then select Sessions > BYOD-Apple-MiniBrowser-Flow, select 'Equals' then 'Yes'
  5. For the Permissions, select 'Standard' > 'NSP_Apple_CNA'
  6. Click 'Done' for the policy rule
  7. Click 'Save' on the bottom to save the policy

Screen Shot 2017-02-01 at 12.45.39 PM.png


ISE Live Log:


  1. User associates to open SSID and ISE assigns 'Cisco_WebAuth' Authorization Profile that redirects any web request to ISE WebAuth portal page
  2. User enters employee user ID ' employee1' and password on the WebAuth portal
  3. A successful login triggers CoA (Change of Authorization)
  4. After CoA endpoint is assigned 'NSP_Apple_CNA' which permits temporary web access so the Apple CNA is no longer enforced. At this stage only traffic to is redirected and used to guide user through BYOD process using full browser
  5. Once BYOD process is completed, user connects to secured SSID and gets 'PermitAccess' Authorization Profile
Cisco Employee
Cisco Employee

I've corrected it to read 'It still does not allow administrator to use a single WLAN for both CNA enabled guest access and employee BYOD, but allows them to enable captive portal bypass selectively per WLAN instead of controller wide.'

Louis Gonzales


Did you ever get past this point?  I'm running into the same issue.  I'm running ISE 2.2 Patch 9 and testing with an iPad running 11.4 (15F79)

Cisco Employee
Cisco Employee

In order for the 'Done' to appear, the iOS device has to be on the Internet or fooled into thinking it is. If you look at the ACL_APPLE_CNA, you can see that it is denying but allowing everything else. If the flow works the endpoint should be assigned the ACL_APPLE_CNA which you can confirm by going to WLC GUI > Monitor > Clients > Client MAC address and scroll down to see the ACL that is applied. If the correct ACL is applied and the Done is not shown then verify that ACL matches what is shown above. If the ACL other than ACL_APPLE_CNA is applied then you will not get the Done to show.

Arne Bier
VIP Advisor VIP Advisor
VIP Advisor

If just stumbled into this discussion after watching the DUAL SSID BYOD Onboarding with this CNA trick. 

I can't get it to work. I never match the Authorization Condition:    Session.BYOD-Apple-MiniBrowser-Flow - and hence I don't end up applying the appropriate ACL


Here is my setup

ISE 2.4 patch 3

Cisco WLC

Apple iOS 12.  


Is this feature still broken?  I have lost the thread on whether this is an iOS issue or an ISE issue?

To make the BYOD onboarding as smooth as possible, it would be nice to allow Apple users to authenticate in the CNA (mini browser) just because it removes any user guesswork.



Jason Kunst
Cisco Employee
Cisco Employee

If its not matching that rule then likely its an issue with iOS 12 that just came out and not updating the posture feed. 2 separate issues it seems perhaps. But Apple AFAIK hasn't updated ios 12 to work with it. Will research it. I found this as well CSCve39167 would recommend working through the TAC and escalating if there is a fix because it hasn't been verified.


also just learned that Apple iOS 12 is not yet provided in feed CSCvm57650

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers
Quick Links