Forum Discussion
Moonlit
Cirrus
CirrusF5 Access 2018 app shows "Unable to retrieve network access configuration" on iPhone 7 with iOS 12 (beta)
F5 Access 2018 app shows "Unable to retrieve network access configuration" on iPhone 7 with iOS 12 (beta) when we use Web Logon for authentication (for OTP codes). If we choose Native authentication (and remove the requirement for OTP), the VPN establishes just fine. On the server side, "Session deleted due to user logout request." when the user receives the error message.
We're using split-tunnel VPN. A user reported getting the above error after upgrading to iOS 12 Beta and installing the F5 Access 2018 app. I have replicated this on a brand new iPhone 7 after upgrading it to iOS 12. Am suspecting this is an iOS 12 Beta bug, but it is a problem nonetheless.
See below for the relevant part of the client logs. I also saw this old thread which refers to the exact same "Error 111" message on iOS as seen in the F5 Access client log: https://stackoverflow.com/questions/20454853/nsxmlparsererrordomain-111
Excerpt from client log:
PacketTunnelProvider.swift, 477, startTunnel(options:completionHandler:), Session has been established
VpnFavoriteListOperation.swift, 110, main(), VPN Favorites failed: Error Domain=NSXMLParserErrorDomain Code=111 "(null)"
PacketTunnelProvider.swift, 484, startTunnel(options:completionHandler:), Network parameters have been received
PacketTunnelProvider.swift, 487, startTunnel(options:completionHandler:), Failed to get NA settings Internal Error: VPN resource was not found
PacketTunnelProvider.swift, 334, displayMessage(_:completionHandler:), Unable to retrieve network access configuration Full log:
2018-07-09,13:23:07:672, 264,7683,PacketTunnel, 48, PacketTunnelProvider.swift, 368, startTunnel(options:completionHandler:), ------------------------------------------------------------
2018-07-09,13:23:07:684, 264,7683,PacketTunnel, 48, PacketTunnelProvider.swift, 369, startTunnel(options:completionHandler:), Release Version: 3.0.0
2018-07-09,13:23:07:698, 264,7683,PacketTunnel, 48, PacketTunnelProvider.swift, 370, startTunnel(options:completionHandler:), Bundle Version: 3.0.0.224
2018-07-09,13:23:07:704, 264,7683,PacketTunnel, 48, PacketTunnelProvider.swift, 371, startTunnel(options:completionHandler:), Build Date: Fri Mar 2 13:20:26 PST 2018
2018-07-09,13:23:07:709, 264,7683,PacketTunnel, 48, PacketTunnelProvider.swift, 372, startTunnel(options:completionHandler:), Build Type: CM
2018-07-09,13:23:07:712, 264,7683,PacketTunnel, 48, PacketTunnelProvider.swift, 373, startTunnel(options:completionHandler:), Changelist: 2509912
2018-07-09,13:23:07:715, 264,7683,PacketTunnel, 48, PacketTunnelProvider.swift, 374, startTunnel(options:completionHandler:), Locale: engelsk (Norge)
2018-07-09,13:23:07:718, 264,7683,PacketTunnel, 48, PacketTunnelProvider.swift, 375, startTunnel(options:completionHandler:), ------------------------------------------------------------
2018-07-09,13:23:07:727, 264,7683,PacketTunnel, 48, PacketTunnelProvider.swift, 382, startTunnel(options:completionHandler:), Connection Parameters: Optional("serverAddress: https://fjerntilgang.tine.no,password: ,ignorePassword: false,passwordExpirationTimeStamp: -1,passwordReference: not-set,passwordExpired: falseidentityReference: not-set,postLaunchUrl: ,webLogon: true,launchedByUriScheme: false,vpnScope: device,startType: manual,deviceIdentity: assignedId: ,instanceId: ,udid: ,macAddress: ,serialNumber: ")
2018-07-09,13:23:42:181, 264,7947,PacketTunnel, 48, PacketTunnelProvider.swift, 166, checkForConfigurationUpdate, Request update configuration with "{
"savePasswordEnabled" : false,
"weblogonAutoPopulateEnabled" : true,
"clearPassword" : false,
"enforceWebLogon" : false,
"enforceLogonMode" : false,
"launchedByUriScheme" : false,
"timeStamp" : -1,
"logonSucceed" : true
}"
2018-07-09,13:23:42:222, 264,7947,PacketTunnel, 48, PacketTunnelProvider.swift, 477, startTunnel(options:completionHandler:), Session has been established (Session ID: c47c4cf6)
2018-07-09,13:23:42:446, 264,12807,PacketTunnel, 1, VpnFavoriteListOperation.swift, 110, main(), VPN Favorites failed: Error Domain=NSXMLParserErrorDomain Code=111 "(null)"
2018-07-09,13:23:42:454, 264,12807,PacketTunnel, 48, PacketTunnelProvider.swift, 484, startTunnel(options:completionHandler:), Network parameters have been received
2018-07-09,13:23:42:459, 264,12807,PacketTunnel, 1, PacketTunnelProvider.swift, 487, startTunnel(options:completionHandler:), Failed to get NA settings Internal Error: VPN resource was not found
2018-07-09,13:23:42:487, 264,12807,PacketTunnel, 1, PacketTunnelProvider.swift, 334, displayMessage(_:completionHandler:), Unable to retrieve network access configuration
boneyardMVP
i kinda assume iOS 12 isn't supported yet. if you can report this to F5 support so they can advance warn the development team. but good chance it won't be solved until iOS 12 is public.
MoonlitThank you. I will create a case with support now that IOS 12 is out. The issue is still extant with exactly the same conditions while using the new "F5 Access" app, version 3.0.2, from App Store.
In our access policy, "OTP Verify" succeeds when the user enters the PIN code from the SMS in the Web Logon screen, then the app displays "Unable to retrieve network access configuration".
The APM log says that our Connectivity profile was assigned correctly, and also "Access policy result: Full".
After that, the server receives client info and then logs "Session deleted due to user logout request".
youssef1Cumulonimbus
Hi,
Hi had a similar problem with one of my customer.
F5 Access Legacy will not be supported on iOS 12 and later versions.
After Apple releases iOS 12, F5 cannot update F5 Access Legacy. Therefore, look for any bug fixes in F5 Access 2018.
When users use F5 Access 2.x on iOS 12, the app will not function and instead will display the following alert: F5 Access Needs to Be Updated. The developer of this app needs to update it to work with iOS 12.
Recommendations
F5 recommends that you upgrade your F5 Access and BIG-IP versions that includes iOS support, according to the F5 Access on iOS compatibility matrix. Apple is currently planning to release iOS 12 in September 2018. Like all release dates, it may change. F5 customers who intend to upgrade to iOS 12 should migrate to F5 Access 3.0.1.
https://support.f5.com/csp/article/K60813274
I uses AirWatch and I fixed my problem following F5 recommendation.
Regards
Hi Moonlit.
VpnFavoriteListOperation.swift, 110, main(), VPN Favorites failed: Error Domain=NSXMLParserErrorDomain Code=111 "(null)"
This error likely might be related to a new bug ID745614. Please share this ID with engineer from TAC and he will confirm/provide the workaround
Regards, Ruslan
- Moonlit
Hi,
This problem is now solved, by F5 through their normal support channel.
The solution was to remove the text in the "Domain Cookie" box, where we previously had our only domain name. It is found in the Access Profile under SSO/Auth Domains on version 13.1.
After removing this, the client was able to use Web Logon in iOS 12.
Thanks to everyone who contributed, especially Jason and his colleague at F5 who made the suggestion!