Troubleshooting ISE Enrollment: When Cellular Data Gets in the Way

If you’ve ever run into the dreaded “Unable to detect Server. Please ensure your network access device is configured to redirect enroll.cisco.com to ISE” error during Cisco ISE onboarding, you’re not alone. After hours of checking ACLs, DNS settings, and network redirects, the culprit might surprise you—it could be your device’s cellular data connection.

The Problem

During device onboarding, Android phones try to reach the ISE server via the network you’re connected to. However, some devices—especially newer models—are smart enough (or maybe too smart) to switch to cellular data if they detect a more “reliable” connection.

This means your enrollment traffic never actually hits the ISE, leading to frustrating errors like:

spw log file from android A15 device using Cisco network setup assistant 3.2 “with” a cellular connection

The log files shows that the device was unable to redirect to Cisco ISE to start the onboarding process.

2025.08.24 01:56:16 INFO:About to apply random number generator fix, if necessary.
2025.08.24 01:56:16 INFO:Done applying random number generator fix.
2025.08.24 01:56:17 INFO:verion :14 SDK Level : 34
2025.08.24 01:56:17 INFO:State :START
2025.08.24 01:56:17 INFO:Starting Discovery
2025.08.24 01:56:17 INFO:Starting ISEDiscoveryAsynchTask
2025.08.24 01:56:17 INFO:DHCP Stringipaddr 10.0.79.33 gateway 10.0.79.23 netmask 0.0.0.0 dns1 10.0.206.21 dns2 0.0.0.0 DHCP server 10.0.66.2 lease 3540 seconds
2025.08.24 01:56:17 INFO:DHCP ipaddress10.0.79.33
2025.08.24 01:56:17 INFO:DHCP gateway10.0.79.23
2025.08.24 01:56:19 ERROR:DiscoverAsynchTask
2025.08.24 01:56:19 ERROR:java.net.SocketTimeoutException: failed to connect to /10.0.79.23 (port 80) from /10.0.79.33 (port 49808) after 2000ms
2025.08.24 01:56:19 ERROR:failed to connect to /10.0.79.23 (port 80) from /10.0.79.33 (port 49808) after 2000ms
2025.08.24 01:56:21 ERROR:DiscoverAsynchTask
2025.08.24 01:56:21 ERROR:java.net.SocketTimeoutException: failed to connect to enroll.cisco.com/72.163.1.80 (port 80) from /10.0.79.33 (port 38738) after 2000ms
2025.08.24 01:56:21 ERROR:failed to connect to enroll.cisco.com/72.163.1.80 (port 80) from /10.0.79.33 (port 38738) after 2000ms
2025.08.24 01:56:21 ERROR:Unable to discover ISE Server
2025.08.24 01:56:21 INFO:Internal system error.

spw log file from android google pixel 7 Pro device using Cisco network setup assistant 3.2 “without” a cellular connection

2025.08.24 02:09:21 INFO:About to apply random number generator fix, if necessary.
2025.08.24 02:09:21 INFO:Done applying random number generator fix.
2025.08.24 02:09:22 INFO:verion :14 SDK Level : 34
2025.08.24 02:09:22 INFO:State :START
2025.08.24 02:09:22 INFO:Starting Discovery
2025.08.24 02:09:22 INFO:Starting ISEDiscoveryAsynchTask
2025.08.24 02:09:22 INFO:DHCP Stringipaddr 10.0.78.33 gateway 10.0.78.23 netmask 0.0.0.0 dns1 10.0.206.21 dns2 0.0.0.0 DHCP server 10.0.66.2 lease 3540 seconds
2025.08.24 02:09:22 INFO:DHCP ipaddress10.0.78.33
2025.08.24 02:09:22 INFO:DHCP gateway10.0.78.23
2025.08.24 02:09:22 INFO:Discoverng ISE http return code :200
2025.08.24 02:09:22 INFO:Parsing URL =https://dmzwireless.netprojekralac.com:8443/portal/gateway?sessionId=11CF000A00004FB1DAB12833&portal=ca56e6cb-86a7-4d04-8780-696ad338e9c6&action=cwa&token=601bc8e0d461c0b65dd18a09570bf685&redirect=http://10.0.78.23/auth/discovery/
2025.08.24 02:09:22 INFO:ISEServer =dmzwireless.netprojekralac.com
2025.08.24 02:09:22 INFO:ISEPort =8443
2025.08.24 02:09:22 INFO:session =11CF000A00004FB1DAB12833
2025.08.24 02:09:22 INFO:Discovered using gateway :390987786
2025.08.24 02:09:22 INFO:Discovered ise server = dmzwireless.netprojekralac.com
2025.08.24 02:09:22 INFO:Discovered client mac = 02-00-00-00-00-00
2025.08.24 02:09:22 INFO:Downloading config fromdmzwireless.netprojekralac.com
2025.08.24 02:09:22 INFO:Downloaded xml = <?xml version="1.0" encoding="UTF-8"?><spwProfile xmlns="spwProfile">
    <name>NSP_09272024</name>
    <spw_xml_version>2.0</spw_xml_version>
    <description>WLAN 09272024</description>
    <OSs>
        <os>ALL</os>
    </OSs>
    <ConnectionSetting>
        <connectionTypes>
            <connectionType>wireless</connectionType>
        </connectionTypes>
        <wifiSSIDs>
            <SSID>09272024</SSID>
        </wifiSSIDs>
        <EAPConfig>
            <EncryptionTunnel>

The Fix

The solution is deceptively simple: turn off cellular data on the device during enrollment.

Once cellular is disabled, the device is forced to use Wi-Fi. All DNS redirects and captive portal configurations work as intended, and the device can successfully enroll with ISE.