cisco ise byod onboarding MAC os 10.9.5

[Peter Hagenaars]

Hi Guys

i have the following issue with BYOD registration. 

Latest Java version installed on a Macbook (IOS 10.9.5) then logged on to the client wirelless BYOD Network. 

Then I get a redirect to the ISE server to register my device after that  the CISCO Network Assistant is downloaded and started. This installation failed with (MacOSxpwizard 1.0.0.21)

I know there is a newer version (MacOSxpwizard 1.0.0.27) but this version won't even start.

However, when I manually start the CISCO Network Assistant I get the following:

EUCs-MacBook-Air:~ euc$ cd /var/folders/_0/nfr888s97czbcdtc69yj44hc0000gn/T/SPW.app/Contents/MacOS

EUCs-MacBook-Air:MacOS euc$ ls

SPW

EUCs-MacBook-Air:MacOS euc$ sudo ./SPW

Password:

2014-10-20 13:47:12.229 SPW[1366:507] grep returned:

An asterisk (*) denotes that a network service is disabled.

(1) Bluetooth DUN

(Hardware Port: Bluetooth DUN, Device: Bluetooth-Modem)

(2) Wi-Fi

(Hardware Port: Wi-Fi, Device: en0)

(3) Bluetooth PAN

(Hardware Port: Bluetooth PAN, Device: en2)

(4) Thunderbolt Bridge

(Hardware Port: Thunderbolt Bridge, Device: bridge0)

2014-10-20 13:47:12.268 SPW[1366:507] grep returned:

Ethernet is not a recognized network service.

** Error: The parameters were not valid.

-----BEGIN CERTIFICATE REQUEST-----

MIIC2DCCAcACAQAwFjEUMBIGA1UEAwwLcnNjaGFhcmVtYW4wggEiMA0GCSqGSIb3

DQEBAQUAA4IBDwAwggEKAoIBAQD1kT0GBWb/QfOSx+YC3w2/ULUaHD3cA0AfgIaI

XiCxS/Y9vR8Cht0NlSDd9foT1Y1lVaNYlM+LTTGnYdeCI/tSvFXBOfIfoyCYWyzn

a6v2dxkzOx1DXlAJ80JWxiKVY94miBkIDmo5MG2suJIvSvtOkaSMNSODAp4IHecN

YTcOxUcPLGQvbGpEZI7LqxSpxl6SnPlTR/r1lUXXzPHFUjQj3P6zghobFlQx7ngm

dpkKsQa4UMt62DTt7R0vr0ma8KS9yBOJzJ5pbLQNUnVvoMxYPW1dG7jyNpGKY/QN

WoWGuamxWAGv+Ciywcx3T3t5KLPkGC94K07z0YeJlShHdE9xAgMBAAGgfTAtBgkq

hkiG9w0BCQ4xIDAeMBwGA1UdEQQVMBOGETY4LUE4LTZELTAyLTUxLTc0MEwGCSqG

SIb3DQEJBzE/DD1hYzE0ZjgxMjAwMDNjMzUxNTQ0NGNmZGM6NWM2MGYwNWYtMzk4

MC00MDk0LTgwM2MtNzJkODg3MGNkYWNlMA0GCSqGSIb3DQEBBQUAA4IBAQCrFDk7

Sa5W4ALsTNgCEewcsYJE1K8l/GWmXOgVIm31kssvj3OjaPcUYpr50qelZZWhcSlo

+EDNJyBbyXBgA6SkvbuNefRNoTx6YncOpKi92kHtddTD7LF1AodS0z1BuLM/zgJq

t+o2utt4WLo+ZoUtiTiCqRbSTmFjUNoh0PY/mHazwBfpNKe7Qbdu3BrWY07LHRM2

UNXsS/XhjDz5+Mc6jHeAVOseffGi+bMhuRCX36fOmloNqvvBQqBEk2YACHuEeHA9

EnFYk6+XhWCBo1scEJCrSMNHv0JtkF0vSeSpyvbzZMy+UPMtWBuIvS8jrHOXmKhn

41Fl29ZsTNGepJif

-----END CERTIFICATE REQUEST-----

2014-10-20 13:47:15.770 SPW[1366:507] transection id is  BA9EF79E-9F01-4326-98C9-231A944708AD

2014-10-20 13:47:15.976 SPW[1366:507] 200

2014-10-20 13:47:15.977 SPW[1366:507] {

    Connection = close;

    "Content-Length" = 0;

    Date = "Mon, 20 Oct 2014 11:47:15 GMT";

    Server = "";

    "Trans-Status" = Error;

}

Any idea why this is going wrong?

Regards 

Peter

[Charlie Moreton]

Peter,

If your ISE is 1.2.1, you would need to wait for the next patch (#3) 
to use version 1.0.0.27 as it meant for Java-less provisioning.

You are likely running into this known defect — CSCur09439 ISE OS X 10.9.5 SCEP 
EAP-TLS flow fails

Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question.  Otherwise, feel free to post follow-up questions.

Charles Moreton

[Charlie Moreton]

Just got official word from the Business Unit that the release of 1.0.0.29 and patches for ISE have been pushed back to nest week.

"Plan is to get 1.2.0 patch 12 tested with respective SPW and MAC agent for OSX 10.10 asap, then we follow with OSX 10.10 tested support in 1.2.1 patch 3.

Current ETA for 1.2.0 p12 is mid next week. Don't have ETA for 1.2.1 p3 as of yet. "

[Charlie Moreton]

These files are now available for download.

ISE 1.2 patch 12

ISE 1.2.1 patch 3

ISE 1.3

All are now available on CCO

SPW for MAC 1.0.0.29 and 1.0.0.30

Open Caveats :

1. Users need to do a fresh installation of MAC Agent v4.9.5.3 on MAC 10.10. Need to uninstall any older agents, if installed already
2. In case of Signing signature check failures during MAC Agent installation on MAC 10.10, users have to explicitly select the “Anywhere” option, which is specified under MAC OS X  machine “System Preferences” ->  “Privacy”
3.    On provisioning latest SPW, if any delay in Success Msg, Turn off and on Wireless and select the appropriate SSID and initiate 802.1x by pressing "connect" button all in the system Network Preferences application.

Refer ISE 1.2 Release note updates for detailed information on Patch 12  

[danielciscoswart]

Attempted the Javaless BYOD onboarding for Mac OSX 10.10 yesterday with SPW 1.0.0.30. on ISE 1.2.1 running the latest patch. The process works very intermittently. Out of 10 attempts only 4 or 5 was completed.