collapse

Search


User Info

 
 
Welcome, Guest. Please login or register.
Did you miss your activation email?

Author Topic: Windows 7/8 BYOD  (Read 7872 times)

Offline peps

  • Cisco Newbie
  • *
  • Posts: 1
  • Reputation: 0
    • View Profile
  • Certification: N/A
Windows 7/8 BYOD
« on: October 03, 2013, 01:48:29 AM »
Dear all, thanks for your videos, they are helping me to set up my ISE.

I come to you with a problem with the BYOD enrollment with client windows 7 and 8.

My windows client does not access the wlan because they do not trust my certificate (of course it is a private CA) and the ISE tryes to find the hostname in active directory, but they are guest and the machine account is not in my ad.

some logs:

Source Timestamp   2013-10-03 09:42:13.758
Received Timestamp   2013-10-03 09:42:13.759
Policy Server   bwifi
Event   5400 Authentication failed
Failure Reason   12511 Unexpectedly received TLS alert message; treating as a rejection by the client
Resolution   Ensure that the ISE server certificate is trusted by the client, by configuring the supplicant with the CA certificate that signed the ISE server certificate. It is strongly recommended to not disable the server certificate validation on the client!
Root cause   While trying to negotiate a TLS handshake with the client, ISE received an unexpected TLS alert message. This might be due to the supplicant not trusting the ISE server certificate for some reason. ISE treated the unexpected message as a sign that the client rejected the tunnel establishment.

     11006   Returned RADIUS Access-Challenge
     11001   Received RADIUS Access-Request
     11018   RADIUS is re-using an existing session
     12304   Extracted EAP-Response containing PEAP challenge-response
     12318   Successfully negotiated PEAP version 0
     12812   Extracted TLS ClientKeyExchange message
     12804   Extracted TLS Finished message
     12801   Prepared TLS ChangeCipherSpec message
     12802   Prepared TLS Finished message
     12816   TLS handshake succeeded
     12310   PEAP full handshake finished successfully
     12305   Prepared EAP-Request with another PEAP challenge
     11006   Returned RADIUS Access-Challenge
     11001   Received RADIUS Access-Request
     11018   RADIUS is re-using an existing session
     12304   Extracted EAP-Response containing PEAP challenge-response
     12511   Unexpectedly received TLS alert message; treating as a rejection by the client
     11504   Prepared EAP-Failure
     11003   Returned RADIUS Access-Reject


Does someone succeeded to do the onboarding procedure with windows clients?

Offline MC

  • Global Moderator
  • Cisco Guru
  • *****
  • Posts: 379
  • Reputation: 606
  • CCIE x3 (RS,Sec,SP)
    • View Profile
  • Certification: CCIE
Re: Windows 7/8 BYOD
« Reply #1 on: October 03, 2013, 05:30:39 PM »
Hi peps, welcome to the forum
Could you provide more information about your setup? Are you doing single or dual SSID? I am assuming you are doing single because it sounds like the user is failing PEAP authentication when it first try to connect to the SSID.
Client is rejecting the cert because it is not trusted (another reason to install 3rd party cert) but usually when user double click on the SSID, they should be prompted to accept the cert (options are Terminate or Connect), but I have seen cases where it won't pop up and you will just have to manually create a wireless profile to ignore certificate validation check.
Also, with BYOD, you shouldn't be checking for machine credential since these are non-domain computers. If you do, you will want to remove it.
You can follow the configuration steps by watching the single SSID BYOD video.

You are not allowed to view links. Register or Login

Offline adecisco

  • Cisco Newbie
  • *
  • Posts: 96
  • Reputation: 10
  • Discovering new solution is sweet!
    • View Profile
    • http://adeolaade.blogspot.com/
  • Certification: N/A
Re: Windows 7/8 BYOD
« Reply #2 on: October 16, 2013, 07:58:42 PM »
Dear Pep,

You don't use machine hostname for on-boarding rather you user either domain users or OU created for authorize user for device on-boarding. It should be clear that the reasons for device registration or on-boarding is because you want a personal device (not a domain devices) to gain secure access to the network.

Also you will need to setup a CA is your setup is for testing as you need valid CA to make the process painless experience. At this stage of yours you should not try to reinvent the wheel it can be painful but go with what best practices require for a predictive result.

Regards,
Technology makes life easy but I hope the same technology will not send man back to stone age!

Offline C

  • Cisco Newbie
  • *
  • Posts: 1
  • Reputation: 0
    • View Profile
  • Certification: CCNP
Re: Windows 7/8 BYOD
« Reply #3 on: January 14, 2014, 10:07:37 AM »
I have a similar problem with single SSID BYOD. The test Windows 7 does not pop up the window to let me select whether to receive the cert or not. I have to manually create the profile, which obviously is not a good solution for BYOD.
I did some research on Internet, people say that's Windows problem. Is there any fix for Windows to pop up the window when it receive cert from ISE for PEAP authentication? Or is Dual SSID recommend in this situation?

Thank you!

Offline MC

  • Global Moderator
  • Cisco Guru
  • *****
  • Posts: 379
  • Reputation: 606
  • CCIE x3 (RS,Sec,SP)
    • View Profile
  • Certification: CCIE
Re: Windows 7/8 BYOD
« Reply #4 on: January 16, 2014, 04:21:47 AM »
From what i have seen, problem with the popup usually happen with computer that have been joined to another domain with possibly some security software installed, but not so much of a non-domain computer which is usually the case for BYOD. To my knowledge, there is not really a solution for this. Dual-SSID would be a work around and you can even keep the final SSID hidden if you want. Just make sure you use a trusted 3rd party cert for the guest portal to avoid user having to accept the cert warning.

 

Related Topics

  Subject / Started by Replies Last post
2 Replies
2437 Views
Last post November 22, 2013, 01:09:20 PM
by MC
1 Replies
2121 Views
Last post March 17, 2014, 09:55:04 PM
by MC
13 Replies
8463 Views
Last post November 20, 2014, 10:14:13 PM
by MC
1 Replies
2086 Views
Last post November 19, 2014, 07:18:45 PM
by dong
1 Replies
640 Views
Last post January 02, 2018, 04:54:56 AM
by MC

SimplePortal 2.3.5 © 2008-2012, SimplePortal