I am trying to setup device onboarding with Cisco ISE all are working fine until I got to a stage where iPAD return an error that SCEP server could not be contacted but this is not same from using connectivity test from ISE.

I have setup this two on my SCEP container at different time:

You are not allowed to view links. Register or Login

You are not allowed to view links. Register or Login

I receive connectivity response from both but Apple iPAD return SCEP could not be contacted. Any help I definitely know I am missing something here.

Here is exact error message:

"Profile Installation failed: The SCEP server returned an invalid response"

This is the log I have from my CA server:

"The Network Device Enrollment Service cannot convert encoded portions of the client's http message, or the converted message is larger than 64K (0x80004003).  Invalid pointer"

Thanks for your prompt reply.

Cheer.

The CA is Window 2008.

Thanks for your reply I will definitely go through the video to cross check where things are missing.
In the meanwhile, what can you make out of this message from window 2008 server:

"The Network Device Enrollment Service cannot decrypt the client's PKCS7 message (0x80090005).  Bad Data"

Thanks.

Thanks for your help..I got where the problem is the Window 2008 server is not R2 so other feature that could have made byod to work was not present.

Regards,

The User template has been working just fine for me although you would need to modify it to use attribute specified as in the cert request. Using iPhone Config utilities is certainly another good way to test SCEP. Share screen shot if you could for the others benefit. 
Just curious, which MDM vendor do you integrate with and how well does it work?

adecisco, unfortunately, no. iPEP requires an appliance and we do not have it in our lab.

MC we are using Citrix XenMobile that was formally known as Zenprise. We have over 100 Apple devices on it and it works well. Currently our mobile device sit on segregated network where they only get internet access but we are going to enroll them all in our Corp network using SCEP. XenMobile works pretty slick for this. Too bad Android device don't support SCEP as we are allowing users to pick those device too.

unibog, If you have MDM integration setup on ISE, shouldn't ISE be able to push out cert to Android, although Android will require Cisco Network Setup Assistant installed?

MC, I haven't done much with ISE for the Andriod yet. I found a good book called Cisco ISE for BYOD and Secure Unified Access from Cisco Press that has lots of examples on mobile devices enrollment. I just need to setup in our lab before we put it into production.

Here is the URL for the book.
You are not allowed to view links. Register or Login