Hi, We recently upgraded an ISE 2.2 patch 11 deployment to 2.4 patch 6. We also changed the ISE 802.1x, Admin and Portal certificate to a public GoDaddy cert. We restored the ISE internal CA (using the CLI application configure ISE...), and BYOD is working for most cases. The issue that was flagged recently is that we are no longer able to onboard iOS devices. We just tested a Windows 10 and Apple MAC OS X and both onboarded successfully. The Apple iPad is running iOS 12.2. The iPad successfully passes PEAP authentication, downloads and installs the first profile (GoDaddy Root), then downloads a second profile named Profile Service (Cisco Systems) with contains the ISE cert (Verified in green) and its chain (3 certs from GoDaddy) + an Encrypted Profile Service https://ise-fqdn:port/auth/OTAMobileConfig?session-id=.... When installing this profile, the iPad generates a CSR and then fails. The message displayed is : Profile Installation Failed The Registration Authority's response is invalid.   anyone seen a similar issue? any help would be appreciated. I opened a TAC case and waiting for their response. Thank you, Patrick ... View more

ASA 9.3(2) introduced the concept of zones with ECMP support across different interfaces (in the same zone): You can group interfaces together into a traffic zone to accomplish traffic load balancing (using Equal Cost Multi-Path (ECMP) routing), route redundancy, and asymmetric routing across multiple interfaces.   Any idea when FTD will support this? the interface zone in FMC seems to be for Snort, not for ASA Lina, only nameif is present in Lina CLI: firepower# show nameif Interface Name Security Ethernet1/5 inside1 0 Ethernet1/6 inside2 0   firepower# show zone firepower#   EIGRP neighbors come up on both interfaces but routes are only present on inside1. Is there a recommended design for FTD using L3 routing to 2 Nexus switches? I can't have EIGRP neighbors on vPC VLANs... so I opted for L3 routed interfaces between the 2 Nexus and between each Nexus and FTD.   Thanks Patrick   ... View more

I am running into an issue with ISE 2.2 patch 4 running the latest SPW for MAC OS X with the latest HighSierra update 10.13.2. BYOD flow does not work, it fails inside the Cisco Network Setup Assistant at the early step of downloading profiles. It shows 2 popups for ISE certificate to be trusted then fails to actually import them into the certificate store. anybody experiencing the same issue? ... View more