Cisco ISE conforms to these protocol standards, Requests for Comments (RFCs), and IETF drafts:

Verified IEEE standards

• IEEE802.1X-Std-2001

• IEEE802.1X-Std-2004

Verified IETF RFC

• RFC2138 - RADIUS

• RFC2246 - TLSv1.0

• RFC2548 - Microsoft Vendor-specific RADIUS Attributes

• RFC2759 - Microsoft PPP CHAP Extensions, Version 2

• RFC2865 - RADIUS

• RFC2866 - RADIUS Accounting

• RFC2867 - RADIUS Accounting Modifications for Tunnel Protocol Support

• RFC2868 - RADIUS Attributes for Tunnel Protocol Support

• RFC2869 - RADIUS Extensions

• RFC3579 - RADIUS Support For EAP

• RFC3580 - IEEE 802.1X RADIUS Usage Guidelines

• RFC3748 - EAP

• RFC4017 - EAP Method Requirements for Wireless LANs

• RFC4851 - EAP-FAST

• RFC5176 - Dynamic Authorization Extensions to RADIUS

• RFC5216 - EAP-TLS Authentication Protocol

• RFC5281 - Extensible Authentication Protocol Tunneled Transport Layer Security Authenticated Protocol Version 0 (EAP-TTLSv0)

• RFC5422 - Dynamic Provisioning Using Flexible Authentication via Secure Tunneling Extensible Authentication Protocol (EAP-FAST)

• RFC5425 - Transport Layer Security (TLS) Transport Mapping for Syslog

• RFC6587 - Transmission of Syslog Messages over TCP

• RFC7360 - Datagram Transport Layer Security (DTLS) as a Transport Layer for RADIUS

Partially-supported RFC

These RFCs are partially supported:

• RFC2548 - Microsoft Vendor-specific RADIUS Attributes

• RFC2882 - Network Access Servers Requirements: Extended RADIUS Practices

• RFC7030 - Enrollment over Secure Transport (EST) (Verified and supported as part of BYOD flow)

• RFC7170 - Tunnel Extensible Authentication Protocol (TEAP) Version 1

Verified IETF drafts

• IETF Draft - PEAP Version 0

• IETF Draft - PEAP Version 1

• IETF Draft - PEAP Version 2

• IETF Draft - Microsoft EAP CHAP Extensions Version 2

AAA attributes for RADIUS proxy service

For RADIUS proxy service, these AAA attributes must be included in the RADIUS communication:

• Calling-Station-ID (IP or MAC_ADDRESS)

• RADIUS::NAS_IP_Address

• RADIUS::NAS_Identifier

AAA attributes for third-party VPN concentrators

For VPN concentrators to integrate with Cisco ISE, these AAA attributes should be included in the RADIUS communication:

• Calling-Station-ID (tracks individual client by MAC or IP address)

• User-Name (tracks remote client by login name)

• NAS-Port-Type (helps to determine connection type as VPN)

• RADIUS Accounting Start (triggers official start of session)

• RADIUS Accounting Stop (triggers official end of session and releases ISE license)

• RADIUS Accounting Interim Update on IP address change (for example, SSL VPN connection transitions from Web-based to a full-tunnel client)

For VPN devices, the RADIUS Accounting messages must have the Framed-IP-Address attribute set to the client’s VPN-assigned IP address to track the endpoint while on a trusted network.

These Apple iOS versions have been verified with Cisco ISE for BYOD and posture workflows.:

• Apple iOS 26.x

• Apple iOS 18.x

• Apple iOS 17.x

• Apple iOS 16.x

• Apple iOS 15.x

• Apple iOS 14.x

• Apple iOS 13.x

• Apple iOS 12.x

• Apple iOS 11.x

While Apple iOS devices use Protected Extensible Authentication Protocol (PEAP) with Cisco ISE or 802.1x, the public certificate includes a CRL distribution point that the iOS device needs to verify but it cannot do it without network access. Click “confirm/accept” on the iOS device to authenticate to the network.

For Apple iOS 12.2 and later, manually install the downloaded profile through Settings > General > Profile. After the first profile installation, choose Settings > General > About > Certificate Trust Settings > Enable Full Trust For Root Certificate for the installed profile. To ensure successful installation, verify that your RSA key size is at least 2048 bits. For iOS 13 and later, you must also regenerate the self-signed certificate for the portal role, ensuring the FQDN is included in the SAN field and the signature algorithm is set to SHA-256 or higher.

These Apple macOS versions have been verified for BYOD and posture workflows.

Cisco ISE does work with earlier release of AnyConnect 4.x. However, only newer AnyConnect releases support newer features.

Restriction

For Apple macOS 11, you must use Cisco AnyConnect 4.9.04043 or above and MAC OSX compliance module 4.3.1466.4353 or above.

If you are using Apple macOS 11, you might see a prompt to install the profiles manually when you are installing the Cisco Network Setup Assistant. In this case, follow these steps:

1. Navigate to the Downloads folder.

2. Double-click the cisco802dot1xconfiguration.mobileconfig file.

3. Choose System > Preferences.

4. Click Profiles.

5. Install the profiles.

6. Click OK in the prompt that is displayed in the Cisco Network Setup Assistant to proceed with installation.

Because browsers limit reported macOS versions to 10.15.7 to enhance user privacy, Apple macOS 11 endpoints cannot be uniquely identified during provisioning or classification. This limitation impacts CP policy matching in Posture and BYOD flows, as well as profiling policy matching. As a workaround, map CP policies for macOS 11 endpoints to "macOS All."

You can use the Agentless Posture feature with all the supported Apple macOS releases. Refer to the topic "Agentless Posture" in the chapter "Compliance" in the Cisco ISE Administrators Guide for your Cisco ISE release.

The Supplicant Provisioning Wizard bundle for MAC OSX version 3.1.0.1 is common for all Cisco ISE releases.

For information about the Windows and MAC OSX anti-malware, patch management, disk encryption, and firewall products that are supported by the Cisco ISE Posture agent, refer to the Cisco Secure Client Posture Support Charts.

These Google Android versions have been verified with Cisco ISE for BYOD and posture workflows:

• Google Android 16.x

• Google Android 15.x

• Google Android 14.x

• Google Android 13.x

• Google Android 12.x

• Google Android 11.x

• Google Android 10.x

• Google Android 9.x

• Google Android 8.x

• Google Android 7.x

Cisco ISE may not support certain Android OS version and device combinations due to the open access-nature of Android implementation on certain devices.

Ensure that the Location service is enabled on the Android 9.x and 10.x devices before starting the supplicant provisioning wizard (SPW).

Android no longer uses Common Name (CN). The hostname must be in the subjectAltName (SAN) extension, or trust fails. If you are using self-signed certificates, regenerate the Cisco ISE self-signed certificate by selecting the Domain Name or IP Address option from the SAN drop-down list for Portals. To view this window, click the Menu icon () and choose Administration > System > Certificates > System Certificates.

If you are using Android 9.x, you must update the posture feed in Cisco ISE to get the NSA for Android 9.

Google Chromebook is a managed device and does not support the Posture service. Refer to the Cisco Identity Services Engine Administration Guide for more information.

Google Chromebooks require Google Chrome version 49 or later for BYOD and posture workflows in Cisco ISE. If the Cisco ISE BYOD or Guest portal fails to launch in Chrome OS 73 despite a successful URL redirection, you can resolve the issue by manually importing a self-signed certificate. To do this, generate a new self-signed certificate in the Cisco ISE GUI, ensuring both the DNS and IP address are included in the Subject Alternative Name (SAN) field. Export and copy the certificate to the Chromebook, navigate to Settings > Advanced > Privacy and Security > Manage certificates > Authorities to import the file, and then open your browser to attempt the portal redirection.

In Chromebook 76 and later, if you are configuring EAP-TLS settings using an internal CA for EAP, upload the CA certificate chain with SAN fields to the Google Admin Console Device Management > Network > Certificates. Once the CA chain is uploaded, the Cisco ISE generated certificate with SAN fields is mapped under Chromebook Authorities section to consider your Cisco ISE certificate as trusted.

If you are using a third-party CA, you do not have to import CA chain to Google Admin Console. Choose Settings > Advanced > Privacy and Security > Manage certificates > Server certificate Authority and select Use any default Certificate Authority from the drop-down list.

These Linux versions has been verified for BYOD and posture workflows.

This section provides compatibility information for Microsoft Windows operating systems with various Cisco ISE components including supplicants, Cisco Temporal Agent, and AnyConnect versions

Follow these steps to enable wireless redirection in Firefox 70 for BYOD, Guest, and Client Provisioning portals:

1. In the Cisco ISE GUI, click the Menu icon () and choose Administration > System > Settings > Security Settings.

2. Check the Allow SHA1 ciphers check box. SHA1 ciphers are disabled by default.

3. In your Firefox browser, choose Options > Privacy & Settings > View Certificates > Servers > Add Exception.

4. Add https://<FQDN>:8443/ as exception.

5. Click Add Certificate and then refresh your Firefox browser.

You can use the Agentless Posture feature with all the supported Microsoft releases. Refer to the topic "Agentless Posture" in the chapter "Compliance" in the Cisco ISE Administrators Guide for your Cisco ISE release.