collapse

Search


User Info

 
 
Welcome, Guest. Please login or register.
Did you miss your activation email?

Author Topic: ISE 1.4 BYOD Onboarding Dual SSID  (Read 13042 times)

Offline LDESA

  • Cisco Newbie
  • *
  • Posts: 7
  • Reputation: 0
  • Certification: CCNP
ISE 1.4 BYOD Onboarding Dual SSID
« on: November 24, 2015, 09:03:40 AM »
Good day,

I have followed your steps from SEC0190 but I am unable to get things working over wireless only via wired. The Network Setup Assistant gives the error attached. Please find attached as well spwProfileLog.
The device is able to get registered, it prompts me to install the certificate, which I am able to do so, however at a certain point Network Setup Assistant gives that error and the ISE-Internal SSID with its parameters do not get installed on the machine.
Furthermore, if I add the SSID ISE-Internal manually on the windows machine, it works fine as well, but thats not the goal. ISE-Internal should be provisioned automatically on the machine.

Please help.

Thanks

Offline MC

  • Global Moderator
  • Cisco Guru
  • *****
  • Posts: 398
  • Reputation: 606
  • CCIE x3 (RS,Sec,SP)
  • Certification: CCIE
Re: ISE 1.4 BYOD Onboarding Dual SSID
« Reply #1 on: November 27, 2015, 08:24:13 PM »
What happen if you try this on iOS or Android devices?

Offline LDESA

  • Cisco Newbie
  • *
  • Posts: 7
  • Reputation: 0
  • Certification: CCNP
Re: ISE 1.4 BYOD Onboarding Dual SSID
« Reply #2 on: December 11, 2015, 11:13:09 AM »
I have tried with android but no success. When it gets to the Network Assistant Setup installation part via google play (after device registration), it does not open the webpage even though I have allowed that URL on the access list on the vWLC.

By the way I am a Virtual Wireless Controler and the access point is in flexconnect mode. When I setup guest authentication (followed by the parameter GuestFlow) it works fine using normal normal access lists, but when I try to implement BYOD it does not.

With a vWLC, do I have to use FlexConnect ACLs only?

When you implement BYOD on your videos, on the Authorization Policy Results for CWA, you do not use an Airespace ACL... Does this Airespace ACL work like the dACL for switches? As in for the CWA you specify the redirect ACL then you choose the Airespace ACL to limit the user from accessing specific resources?

Any further ideas please?

Thank you.

Offline MC

  • Global Moderator
  • Cisco Guru
  • *****
  • Posts: 398
  • Reputation: 606
  • CCIE x3 (RS,Sec,SP)
  • Certification: CCIE
Re: ISE 1.4 BYOD Onboarding Dual SSID
« Reply #3 on: December 13, 2015, 09:33:23 PM »
Do you use local or central switching with FlexConnect? ACL on WLC works differently from a switch. First of all, the ACL need to exist on the WLC and ISE just tell which ACL WLC need to use by the name, instead of pushing the while content to WLC like a switch. Second of all, the ACL on WLC acts as both access control and redirect ACL. Basically any traffic denied by ACL will automatically redirected and that's why you do not see Airespace ACL under the Auth Profile for CWA, just the redirect ACL.
You should not be using FlexConnect ACL, but just regular L3 ACL.

Offline LDESA

  • Cisco Newbie
  • *
  • Posts: 7
  • Reputation: 0
  • Certification: CCNP
Re: ISE 1.4 BYOD Onboarding Dual SSID
« Reply #4 on: December 18, 2015, 04:25:33 AM »
Thank you for the explanation, understood.

Regarding your first question, I am assuming I am using central switching as I have not enabled local switching on the WLAN (correct me if I am wrong). Please have a look at the attached screenshot.

I have just gone through all your Certificate Authority videos and then BYOD Dual SSID, but still cannot get it to work. The Network Setup Assistant still fails to install the Internal SSID on my laptop.

As for an android device, I have manually installed the Cisco Network Setup Assistant software beforehand on my device. When I connect to the ISE-BYOD SSID it redirects me to ISE, which then I use the AD credentials and register the device. The last page is to get the Network Setup Assistant. Afterwards I open the software installed beforehand and click START. Finally I get this error "Unable to download profile. (Have you logged into the guest portal?)"

As for an iPhone, I register the device then it asks me to install the certificates. I am able to install the root certificate but I am not able to install the access.ise.local certificate (Wildcard certificate that you created on your videos). It says that "The server certificate for You are not allowed to view links. Register or Login........  is invalid."

Any ideas please?

Thanks

Offline LDESA

  • Cisco Newbie
  • *
  • Posts: 7
  • Reputation: 0
  • Certification: CCNP
Re: ISE 1.4 BYOD Onboarding Dual SSID
« Reply #5 on: December 18, 2015, 05:26:17 AM »
Just to add to the last post. I tested BYOD on two Samsung cellphones but they both had the same behavior. However, I have just tried on a Huawei android cellphone and it worked just fine. It installed the certificates just fine and then I got switched to the ISE-Internal SSID which then I had access to everything.

Why is it not working for the other devices and laptops?

Offline MC

  • Global Moderator
  • Cisco Guru
  • *****
  • Posts: 398
  • Reputation: 606
  • CCIE x3 (RS,Sec,SP)
  • Certification: CCIE
Re: ISE 1.4 BYOD Onboarding Dual SSID
« Reply #6 on: December 20, 2015, 10:46:38 PM »
Are you using wildcard cert on ISE? It is a little concerning that iPhone does not work neither. It is usually device with the highest success rate.
Do you have full admin right on Windows PC?
Are you using internal CA or external SCEP CA?

Offline LDESA

  • Cisco Newbie
  • *
  • Posts: 7
  • Reputation: 0
  • Certification: CCNP
Re: ISE 1.4 BYOD Onboarding Dual SSID
« Reply #7 on: December 21, 2015, 03:38:02 AM »
Yes I am using a WILDCARD cert has per your videos (SEC0187). I have already tried Internal CA and external SCEP CA. But both do not work.
I also have full admin rights on the Windows PC.

Please see attached screenshots regarding the certificates.

What am I possibly doing wrong?

Offline MC

  • Global Moderator
  • Cisco Guru
  • *****
  • Posts: 398
  • Reputation: 606
  • CCIE x3 (RS,Sec,SP)
  • Certification: CCIE
Re: ISE 1.4 BYOD Onboarding Dual SSID
« Reply #8 on: December 22, 2015, 10:08:42 PM »
Can you post the ISE cert? May be try to re-install the cert just to make sure it is valid. Hate to say this but worst case you might need to give a fresh install a try. Wouldn't be the first time for me though.

Offline LDESA

  • Cisco Newbie
  • *
  • Posts: 7
  • Reputation: 0
  • Certification: CCNP
Re: ISE 1.4 BYOD Onboarding Dual SSID
« Reply #9 on: January 03, 2016, 10:25:50 PM »
Good day everyone and Happy New Year,

So I have decided to reinstall ISE but now with version 2.0.
I am glad to say that it is finally working :)
I have tried with both internal and external CA and it works perfectly on all devices.
The only thing that I have not been able to make it work, was BYOD on android devices without pre-installing Network Setup Assistant from google play. Even though I have configured a URL (play.google.com) under the redirect access-list on the vWLC with the public IPs configured as well, but still not working.

Any ideas please?

Thanks

Offline MC

  • Global Moderator
  • Cisco Guru
  • *****
  • Posts: 398
  • Reputation: 606
  • CCIE x3 (RS,Sec,SP)
  • Certification: CCIE
Re: ISE 1.4 BYOD Onboarding Dual SSID
« Reply #10 on: January 05, 2016, 10:26:35 PM »
Yeah.. I don't think the URL options under the ACL works the way you may think it should though. All I remembered trying in the past but didn't work. You may still stuck with getting the user to pre-download the app. The only other way I can think off is somehow having a DNS request to google play return an IP of a web proxy and just allow proxy IP on the WLC ACL but that may be too complicated though.

Glad to hear that eveything else works...

 

Related Topics

  Subject / Started by Replies Last post
1 Replies
9488 Views
Last post March 17, 2014, 09:55:04 PM
by MC
1 Replies
11264 Views
Last post November 19, 2014, 07:18:45 PM
by dong
4 Replies
8715 Views
Last post June 16, 2015, 09:08:07 PM
by MC
3 Replies
6443 Views
Last post May 11, 2015, 07:38:07 PM
by MC
0 Replies
7837 Views
Last post January 31, 2018, 02:16:19 PM
by tomimma

SimplePortal 2.3.7 © 2008-2024, SimplePortal