MAC OS X unable to download Cisco ISE supplicant agent

[CSCO10675262_2]

Hi,

I have a problem with MAC OS X clients unable to download the Cisco ISE supplicant agent using Safari browser but able to login on the ISE guest portal. If the same client was to login to the ISE guest portal using Firefox; it has no issues downloading the ise supplicant and posture agent.

I have tried to update the Java version on the client to the latest; however it does not resolve the issue. As I am new to MAC OS clients; I was wondering what may be the cause of the issue?

I have summarized the issue as follows:

1. MAC OS X 10.8 with safari 6 -- unable to download agent but can login successfully on the Cisco ISE guest portal

2. MAC OS X 10.8 with Firefox -- able to login to Cisco ISE guest portal and download agents; no issues

3. MAC OS X 10.7 with safari and firefox ---  unable to download agent but can login successfully on the Cisco ISE guest portal

4. Windows XP & Windows 7 & Iphone/Ipad/Android -- able to login/download agent without any issues

Any suggestions is appreciated.

Thanks.

[Venkatesh Attuluri]

For Agent Download Issues on Client Machine

• Ensure that a client provisioning policy exists in Cisco ISE. If yes, verify the

policy identity group, conditions, and type of agent(s) defined in the policy.

(Also ensure whether or not there is any agent profile configured under Policy >

Policy Elements > Results > Client Provisioning > Resources > Add > ISE

Posture Agent Profile, even a profile with all default values.)

• Try reauthenticating the client machine by bouncing the port on the access

switch.

Remember that the client provisioning agent installer download requires the following:

• The user must allow the ActiveX installer in the browser session the first time an agent is installed

on the client machine. (The client provisioning download page prompts for this.)

• The client machine must have Internet access.

Client Machine Operating Systems and Agent Support in Cisco ISE

Check the following link

http://www.cisco.com/en/US/docs/security/ise/1.1.1/compatibility/ise_sdt.html#wp95449

[CSCO10675262_2]

Hi Venkatesh,

Thank you for the information. It turns out to be Java issue on  the client PCs. I have a weird problem with MAC OS 10.6, it seems to  prompt an error during the posture agent initilization on the client. It  would require that the root certificate be trusted on the client for it  work/proceed for the NAC agent. This is not required for MAC OS X  10.7/10.8; not too sure if there may be any workaround to remove the  requirements on requiring to trust the root certificate manually for MAC  OS X 10.6? The ISE certificate is trusted on the client automatically though

Thanks.