Cisco RA VPN Issue only on mobile devices

[justclash4]

Hi there,

We have a weird issue. We can connect to our RA VPN with cisco secure client on Windows, MacOS and Linux but can not connect to that on both Android and IOS devices.

I turned on debug level for VPN troubleshooting and checked debug logs.

When connecting to RA VPN with a laptop, FTD sends username and password to AAA servers after TLS handshake and everything works well. But when connecting to RA VPN with mobile device, debug logs are different. I attached the screenshots of both situations.

Environment: FMCv standalone 7.2.8 - FTDv standalone 7.2.8

Thank you for your assistance

[MHM Cisco World]

what auth you use for this RA VPN ?
MHM

[justclash4]

Radius Authentication with Cisco ISE

[MHM Cisco World]

Can yoh share 

Debug webvpn anyconnect 255

For both cases 

MHM

[justclash4]

I ran that command, How should I export that for you?
Did you see the attached screenshots?

[MHM Cisco World]

Screenshots is OK 

And last screenshots ypu share debug is mix from anyconnect and aaa traffic I need to debug only anyconnect 

MHM

[justclash4]

This is when using mobile device. VPN logging in debug mode. and that debug command executed.

Normal situation will be attached in next comment

[justclash4]

Normal connection with a laptop.

[MHM Cisco World]

the AAA server group failed 
show aaa-server <<- check this command see if there is reject or timeout 
also do capture on interface direct to AAA servers see if FTD send packet or not to AAA 

MHM

[justclash4]

I just captured packets in both situations.
In a normal connection from desktop client, one radius request sent from ftd to ise and on radius response received from ise.

but when connecting with a mobile device, radius requests sent to ise but no response received.
the username and password that I am using on both clients are same.

[justclash4]

Also, I did perform show aaa-server and all of them are ACTIVE

[MHM Cisco World]

share show aaa-server <<-

also if you use condition in ISE match specific OS then ISE will not reply, this mostly issue with policy set in ISE 

MHM

[justclash4]

Attached.

I just checked the policy set that our RA VPN is using on ISE. there is no OS related configuration. Is there any thing that I should check in ISE?

[MHM Cisco World]

it issue of ISE 

there are timeout count and  accept count 

timeout count is high

can I see policy-set of ISE 

MHM

[justclash4]

Thanks for checking. Its attached.