Check to see if you're running TACACS with command authorization. ... View more

Found the issue. I'm using a TACACS server with command authorization. The enable and show commands were failing with "Command authorization failed.", however, this error was not being logged. On the TACACS server, you will see:   TACACS: TACACS+ authorization request missing both User and Remote-Address attributes   The following commands failed to run, however, they were logged on the TACACS server:   if [catch {cli_exec $cli1(fd) "enable"} result] { error $result $errorInfo if [catch {cli_exec $cli1(fd) "show Cellular 0/1/0 gps | inc stamp" } result ] { error $result $errorInfo   So, $result now contained "Command authorization failed."   When running:   regexp {:\s+[a-zA-Z]+\s+([a-zA-Z]+)\s+(\d+)\s+(\d+:\d+:\d+)\s+(\d+)} $result match mon day tod year    There was no match and so $mon $day $tod and $year were not being created. This is where the first error is logged:   Feb 17 23:15:01.753: %HA_EM-6-LOG: gps_time.tcl: can't read "mon": no such variable Feb 17 23:15:01.753: %HA_EM-6-LOG: gps_time.tcl: while executing Feb 17 23:15:01.753: %HA_EM-6-LOG: gps_time.tcl: "puts "regx = $mon $day $tod $year"" Feb 17 23:15:01.753: %HA_EM-6-LOG: gps_time.tcl: invoked from within   To resolve this, I did the following:   1) create a username on the router with priv 15 and password 2) add - "event manager session cli username "<username>" privilege 15" 3) make sure in Tacacs, there is a username and password pair that matches the one entered on the router. This is what is passed to Tacacs to authenticate. 4) Make sure the enable, show cellular, and clock set commands are authorized for this user. ... View more

I'm running this on a 1921/K9 with an EHWIC-4G-LTE-VZ and running into the same issue. At first, it was the $interface variable having issues. I hard-coded the correct Cellular 0/1/0 interface, but now I'm seeing the $mon variable erorr.  I have GPS coordinates acquired, according to the GPS Status, and the output from "sh Cellular 0/1/0 gps | i stamp" = Timestamp (GMT): Tue Feb 12 20:18:46 2019 which, when using a regex parser, parses out correctly into 4 parts - Feb ($mon), 12 ($day), 20:18:46 ($tod), and 2019 ($year) which should be saved to $mon $day $tod $year according to the code, but throws the below error instead. Feb 13 02:15:01.754: %HA_EM-6-LOG: gps_time.tcl: can't read "mon": no such variable Feb 13 02:15:01.754: %HA_EM-6-LOG: gps_time.tcl: while executing Feb 13 02:15:01.754: %HA_EM-6-LOG: gps_time.tcl: "puts "regx = $mon $day $tod $year"" Feb 13 02:15:01.754: %HA_EM-6-LOG: gps_time.tcl: invoked from within Feb 13 02:15:01.754: %HA_EM-6-LOG: gps_time.tcl: "$slave eval $Contents" Feb 13 02:15:01.754: %HA_EM-6-LOG: gps_time.tcl: (procedure "eval_script" line 7) Feb 13 02:15:01.754: %HA_EM-6-LOG: gps_time.tcl: invoked from within Feb 13 02:15:01.754: %HA_EM-6-LOG: gps_time.tcl: "eval_script slave $scriptname" Feb 13 02:15:01.754: %HA_EM-6-LOG: gps_time.tcl: invoked from within Feb 13 02:15:01.754: %HA_EM-6-LOG: gps_time.tcl: "if {$security_level == 1} { #untrusted script Feb 13 02:15:01.754: %HA_EM-6-LOG: gps_time.tcl: interp create -safe slave Feb 13 02:15:01.754: %HA_EM-6-LOG: gps_time.tcl: interp share {} stdin slave Feb 13 02:15:01.754: %HA_EM-6-LOG: gps_time.tcl: interp share {} stdout slave Feb 13 02:15:01.754: %HA_EM-6-LOG: gps_time.tcl: ..." Feb 13 02:15:01.754: %HA_EM-6-LOG: gps_time.tcl: (file "tmpsys:/lib/tcl/base.tcl" line 50) Feb 13 02:15:01.754: %HA_EM-6-LOG: gps_time.tcl: Tcl policy execute failed: Feb 13 02:15:01.754: %HA_EM-6-LOG: gps_time.tcl: can't read "mon": no such variable   ... View more

By any chance are you using two certificate groups, one with a public cert for guest, byod, blacklist, etc. and one with a private cert for admin, mydevices, sponsor? ... View more

I'm having the exact same problem, but with 3602s.  In my case, I've set the security to none and use MAC filtering via ISE.  I can see the netgear wnce2001 authenticate with no problems and get an IP address from DHCP.  I can also see it associated to the WLC and I can ping it for about 30 seconds.  The WLAN light never comes on and eventually, the LAN light will go off and then come back on and at this point, it's no longer associated to the WLC and I can't ping it. ... View more

Success!!  The clue was this: ERROR:java.io.IOException: Hostname 'guest.domain.com' was not verified Earlier in the log there is an http 200 message indicating a successful query to the ise server, however, this is because the discovery by the network setup assistant is done via http and not https.  When the profile is downloaded, it uses ssl and was failing due to the certificate not being trusted.  I installed a public cert and the profile downloaded and then connected me to the new SSID specified in the profile.  I'm sure if the self-signed certificate in ISE was installed as a trusted CA on the phone, that this would also work. Hope this helps anyone else experiencing this problem.   ... View more

Here's a snipit from the Android spw.log.  I see that there is an error trying to verify the hostname.  Is it possible that this is caused by a non-trusted certificate?  I'm using the self-signed cert built into ISE.  I have an entry in the public DNS for guest.domain.com that resolves to the IP of my ISE server accessible from the guest subnet.  I'm allowing all traffic from the guest VLAN to the ISE vlan on the firewall and all traffic to/from the ISE server in the provisioning ACL I have applied by ISE on the WLC during native supplicant provisioning.  I know that guests can communicate with the ISE server since regular guest portal redirection works, just not the network setup assistant.  I've renamed the domain to domain.com in this snipit.   2014.07.20 23:44:48 INFO:verion :4.4.4 SDK Level : 19 2014.07.20 23:44:48 INFO:State :START 2014.07.20 23:44:48 INFO:Starting Discovery 2014.07.20 23:44:48 INFO:Starting ISEDiscoveryAsynchTask 2014.07.20 23:44:48 INFO:DHCP Stringipaddr 192.168.30.110 gateway 192.168.30.1 netmask 255.255.255.0 dns1 208.67.222.222 dns2 208.67.220.220 DHCP server 192.168.30.1 lease 3600 seconds 2014.07.20 23:44:48 INFO:DHCP ipaddress192.168.30.110 2014.07.20 23:44:48 INFO:DHCP gateway192.168.30.1 2014.07.20 23:44:48 INFO:Discoverng ISE http return code :200 2014.07.20 23:44:48 INFO:ISEServer =guest.domain.com 2014.07.20 23:44:48 INFO:session =0516a8c000001932f37acc53 2014.07.20 23:44:48 INFO:Discovered using gateway :18786496 2014.07.20 23:44:48 INFO:Discovered ise server = guest.domain.com 2014.07.20 23:44:48 INFO:Discovered client mac = 5C-0A-5B-FC-37-0F 2014.07.20 23:44:48 INFO:Server:Key=guest.domain.com:0516a8c000001932f37acc53 2014.07.20 23:44:48 INFO:Downloading config fromguest.domain.com 2014.07.20 23:44:48 INFO:checkServerTrusted call 2014.07.20 23:44:48 INFO:checkServerTrusted call 2014.07.20 23:44:48 ERROR:DownloadprofileAsynchTask 2014.07.20 23:44:48 ERROR:java.io.IOException: Hostname 'guest.domain.com' was not verified 2014.07.20 23:44:48 ERROR:Hostname 'guest.domain.com' was not verified 2014.07.20 23:44:48 INFO:Internal system error.   On the ISE side, here is the snippet of logs during the same time as when the android network setup assistant was run.   2014-07-20 23:41:38,586 INFO   [DefaultQuartzScheduler_Worker-6][] cisco.cpm.infrastructure.utils.NodeGroupFWUtil -:::::- Applied Firewall rules for node group. 2014-07-20 23:42:35,251 INFO   [AbandonedTransactionReaper][] com.cisco.epm.db.AbandonedTransactionReaper -:::::- In AbandonedTransactionReaper :  MaxActive : 20 0 CurrentActive : 0 MaxIdle : 200 MinIdle : 0 CurrentIdle : 2 2014-07-20 23:42:39,394 INFO   [AbandonedTransactionReaper][] com.cisco.epm.db.AbandonedTransactionReaper -::::PDPInitialization:- In AbandonedTransactionReaper :  MaxActive : 200 CurrentActive : 0 MaxIdle : 200 MinIdle : 0 CurrentIdle : 0 2014-07-20 23:42:49,765 INFO   [DataSourceListener Thread][] api.services.persistance.dao.DistributionDAO -:::::- In DAO getRepository method for HostConfig Type : ACTIVE 2014-07-20 23:42:56,805 INFO   [PDP-Heartbeats-0][] com.cisco.cpm.clustering.MnTClient -::::pdpha:- Removing session 0516a8c00000196f2a95cc53 2014-07-20 23:42:56,806 WARN   [PDP-Heartbeats-0][] cpm.nsf.session.impl.SystemStateManager -::::pdpha:- Session 0516a8c00000196f2a95cc53 not found at complete 2014-07-20 23:43:35,441 INFO   [portal-http-844314][] cisco.epm.license.flexlm.FlexlmFileHandler -:::::- Is License Valid for seId [1] = true 2014-07-20 23:43:35,441 INFO   [portal-http-844314][] com.cisco.epm.license.LicensingManager -:::::- License is valid [true] for SeriveType [1] 2014-07-20 23:43:35,750 WARN   [portal-http-844315][] cisco.cpm.guestportal.utils.GuestPortalUtils -::0516a8c000001932f37acc53::guest:- --- GuestPortalUtils: Una ble to determine language. Defaulting to English 2014-07-20 23:43:35,768 WARN   [portal-http-844315][] cisco.cpm.guestportal.utils.GuestPortalUtils -::0516a8c000001932f37acc53::guest:- --- GuestPortalUtils: Una ble to determine language. Defaulting to English 2014-07-20 23:43:35,768 INFO   [portal-http-844315][] cisco.cpm.guestportal.utils.GuestPortalUtils -::0516a8c000001932f37acc53::guest:- initializing page definit ion 2014-07-20 23:43:35,769 INFO   [portal-http-844315][] cisco.cpm.guestportal.utils.GuestPortalUtils -::0516a8c000001932f37acc53::guest:- Created guest theme page def 2014-07-20 23:44:18,090 WARN   [portal-http-844315][] cisco.cpm.guestportal.actions.SelfProvisioningAction -:test:0516a8c000001932f37acc53::guest:- ***BYOD Regi stration Data*** macAddress: 5C:0A:5B:FC:37:0F portalUser: test authStoreName: Internal Users authStoreGuid: 78954c30-e0f0-11e3-af67-005056bf4689 2014-07-20 23:44:18,113 INFO   [portal-http-844315][] com.cisco.epm.jms.AQMessgeHandler -:test:0516a8c000001932f37acc53::guest:- Publishing message for event [T xnCommit / commit] and message class[class com.cisco.epm.pap.api.transaction.Transaction] 2014-07-20 23:44:18,167 WARN   [portal-http-844315][] cisco.cpm.guestportal.utils.GuestPortalUtils -:test:0516a8c000001932f37acc53::guest:- --- GuestPortalUtils : Unable to determine language. Defaulting to English 2014-07-20 23:44:18,168 INFO   [portal-http-844315][] cisco.cpm.guestportal.utils.GuestPortalUtils -:test:0516a8c000001932f37acc53::guest:- initializing page de finition 2014-07-20 23:44:18,169 INFO   [portal-http-844315][] cisco.cpm.guestportal.utils.CoAExecutorService -:test:0516a8c000001932f37acc53::guest:- Issue CoA reauth i n 2000 milliseconds for sessionName 0516a8c000001932f37acc53 2014-07-20 23:44:18,171 WARN   [portal-http-844315][] cisco.cpm.guestportal.utils.GuestPortalUtils -:test:0516a8c000001932f37acc53::guest:- --- GuestPortalUtils : Unable to determine language. Defaulting to English 2014-07-20 23:44:18,172 INFO   [portal-http-844315][] cisco.cpm.guestportal.utils.GuestPortalUtils -:test:0516a8c000001932f37acc53::guest:- initializing page de finition 2014-07-20 23:44:18,173 INFO   [portal-http-844315][] cisco.cpm.guestportal.utils.GuestPortalUtils -:test:0516a8c000001932f37acc53::guest:- Created guest theme page def 2014-07-20 23:44:20,171 INFO   [pool-19-thread-4][] cisco.cpm.guestportal.utils.CoAReauthTask -:test:0516a8c000001932f37acc53::guest:- Running CoAReauthTask for  _sessionName 0516a8c000001932f37acc53 2014-07-20 23:44:20,194 INFO   [pool-19-thread-4][] cisco.cpm.guestportal.utils.CoAReauthTask -:test:0516a8c000001932f37acc53::guest:- Issue Local CoA for sessi on 0516a8c000001932f37acc53 2014-07-20 23:44:50,768 INFO   [ContainerBackgroundProcessor[StandardEngine[Catalina]]][] cpm.admin.infra.action.SessionCounterListener -:::::- sessionDestroyed - deducted one session from counter - Session ID - 0FFE9C73C9209D4EE2534558CB8F723B - Session Count - 0 2014-07-20 23:46:58,502 INFO   [portal-http-844315][] cisco.epm.license.flexlm.FlexlmFileHandler -:::::- Is License Valid for seId [1] = true 2014-07-20 23:46:58,502 INFO   [portal-http-844315][] com.cisco.epm.license.LicensingManager -:::::- License is valid [true] for SeriveType [1] 2014-07-20 23:46:58,693 WARN   [portal-http-844315][] cisco.cpm.guestportal.utils.GuestPortalUtils -::0516a8c000001932f37acc53::guest:- --- GuestPortalUtils: Una ble to determine language. Defaulting to English 2014-07-20 23:46:58,702 INFO   [portal-http-844315][] cisco.cpm.provisioning.cache.FlowStateCacheManager -::0516a8c000001932f37acc53::guest:- Deleted old flow st ate session with device id 5C-0A-5B-FC-37-0F   ... View more

Having the same problem.  Originally, the network setup assistant couldn't find the ISE server until we denied access to the default gateway on port 80 in the WLC ACL for provisioning.  Now it can find the server and I can see requests on the firewall going to ISE on port 8905, however, I'm getting the same error about not being able to download the profile. I'm running ISE 1.2.1 patch 1 and using an Android 4.4.4. ... View more

Thanks for the information David. I was able to successfully run asdm gui 7.1.5.100 using the steps I specified earlier. Once DNS was updated and the root ca cert trusted (or the self-signed cert if not using an enterprise PKI), everything works with no issue, including running the installed ASDM (not from the browser). I suspect that customers running in an enterprise CA environment where the root ca cert is already trusted, and are already using the fqdn to access the ASA, will not see any issues.  The 7.1.5.100 does fix the permissions manifest warning that kept displaying which will make sure that this still works once oracle prevents java apps from running without it. ... View more

Running windows 8.1 with j7u51 and initially had the same problem.  Apparently Java is now doing some strict name checking when using SSL and in my case there were two things that I had to do to get it working: 1) Use the fqdn of the ASA when connecting 2) Trust the root ca cert in windows 1) Verify the fqdn of the ASA and make sure that you can resolve to it using DNS.  Open a browser and go to https:// /admin and verify that you don't get any browser warning about certificates.  If you do, examine the certificate and look at the subject name and/or subject alternate name under details.  DNS needs to resolve to the fqdn listed on the cert.  In my case, I used the fqdn value under the subject alternate name and updated my DNS server with the name.  If you don't have a private DNS server, you can update the host file in windows with the name and IP. 2) You'll also have to trust the root CA in the chain.  Export the root ca certificate by looking at the ASA certificate, going to the certificate path tab and then selecting the root cert and then view it.  You can copy the cert to a file under the details tab of the root ca cert.  Trust the root CA of the ASA by importing the root certificate into the trusted root certification authorities/certificates container in Windows.  To do this, launch "mmc" and add the certificates snap-in.  Expand the Trusted Root Certification folder and right click on Certificates and select "All Tasks\Import".  Browse to the root certificate that you exported earlier and import it in.  You'll need to acknowledge that you want to trust the cert and put it in the correct key container. Once the browser shows no certificate warnings, you should be able to launch the ASDM using the same fqdn that you did in the browser. Hope this helps. ... View more