topic Re: WebAuth redirect does not work WLC/ISE in Network Access Control

WebAuth redirect does not work WLC/ISE

Kn1ghtR1d3rOfD00m — Mon, 11 Mar 2019 06:56:04 GMT

Hello,

I hope you have seen this behavior, if not, please share your ideas. we have a deployment of one PAN and 6 PSN nodes across multiples regions in the world.

Background:

Each location has its own WLC 8500 series and we have a ISE 2.0.

Each WLC redirect to endpoint request to the PAN, the PAN acts as the main central radius.

Behavior:

All sites/branches, the URL redirection portal works fine, in other words, when a endpoint user joing the open SSID Guest, it gets the DHCP settings and when they open or go to any web site, it will automatically redirect to SSL certificate warning and click on continue adn then get the Portal Credentials.

However, on Google Chrome, it does not open, instead, when they type in the address bar any web site, http or https, it will automatically open a new tab saying: gstatic.com/generate_204 and keeps trying until it says a button connect but it does not do anything.

What could be the culplrit of this crap URL redirection?

Troubleshooting made:

We created another WLAN, still the same behavior.

Under the same SSID, we set it up a local web aut redirection portal, the same behavior.

Please check the attach file and you will see what Im saying.

Updated Chrome and does not work on Windows 7

On Windows 10, sometimes it works and sometimes it does not work.

On Chrome books, one work and the other one does not work the first attempt.

Debug the client mac address for the endpoint that works and for the one that does not work. Checked everything and they have the same thing. TAC says that the endpoint receives the URL but for some reason the Chrome stops the process and start the redirection to the gstatic.com web site.

Did a comparison with firefox and IE and Microsoft EDge and debug and Chrome with the same and other laptops and the same config appeared as per Cisco TAC.

They could not determine right away if this was a problem with the WLC or the Chrome app. But do I know that it should be compatible with all top browsers like chrome.

Why it does not work on on WLC if the solution and design was to have the same config across all regions.

Only on on brach does not work. other ones work fine.

I regirsted one AP on another WLC and it worked fine.

other region reigisted their AP with own WLC and the first time they got the gstatic.com web site

Is it the WLC faulty or what?

Pleas help, what else could I try and prove it is the WLC config or damaged, corrupted , it is very weird cause as I mentioned before, it works fine on firefox, IE, Opera, etc, execpt Google Chrome and Chrome OS, but only on this site, but other say they have not experienced this issue.

Thank you for your help,

Hi,

M.Netuschil5148 — Fri, 22 Jul 2016 06:42:29 GMT

Hi,

can you tell us what versions do you using on the WLC and on the ISE with Patch?.

BR,

Mario

Re: WebAuth redirect does not work WLC/ISE

cassiohonorio — Tue, 16 Jan 2018 15:47:19 GMT

Did You Find Some Solution

Re: Hi,

dalporto34 — Wed, 21 Feb 2018 00:08:15 GMT

Has there been a resolution to this issue?

Re: WebAuth redirect does not work WLC/ISE

dalporto34 — Fri, 23 Feb 2018 19:39:07 GMT

Has there been a remedy to your issue, we are seeing this issue also. Very odd that the page doesn't work with Chrome, but is receiving the proceed link in Mozilla Firefox and Safari.

Re: WebAuth redirect does not work WLC/ISE

cassiohonorio — Fri, 23 Feb 2018 19:42:14 GMT

The TAC wants me to do this.

The solution is adding your ISE self-signed certificate to the trusted zone of your browser. Unfortunately, it is Google Chrome’s security feature.

Re: WebAuth redirect does not work WLC/ISE

daemibros — Mon, 12 Mar 2018 20:05:28 GMT

i have done this and still its not working. This is the default self-signed server certificate in system certificates under certificates in ISE right? IE works fine but chrome and mozilla are not redirecting

Re: WebAuth redirect does not work WLC/ISE

daemibros — Mon, 12 Mar 2018 20:09:53 GMT

So in a large deployment...i guess if adding the self-signed is a solution, then this cert will have to be pushed to all the clients...Or how to go about it?

Re: WebAuth redirect does not work WLC/ISE

jan.nielsen — Wed, 14 Mar 2018 20:53:46 GMT

Your redirect ACL content would be interesting to see. Regarding Chrome, the gstatic url, is the url that chrome uses to detect if it has internet access, and if it's being blocked somehow, what you should see is the redirect to your portal, but i would suggest you get yourself a trusted public cert instead of some self-signed cert, also certs with SHA1 and not SHA256 algorithm (minimum) , will also have issues and chrome is especially security aware.

Re: WebAuth redirect does not work WLC/ISE

dalporto34 — Thu, 15 Mar 2018 15:37:14 GMT

We already have a public certificate in place.

Re: WebAuth redirect does not work WLC/ISE

jan.nielsen — Thu, 15 Mar 2018 16:04:58 GMT

Ok, but are you sure thats the cert that ise is actually sending to the browser? Also, if the cert is sha1, chrome will still not like it.

Re: WebAuth redirect does not work WLC/ISE

Josh.Kurtz — Mon, 17 Dec 2018 18:55:45 GMT

I have this same issue, even before the user gets past the web redirect acl, the controller is proxying connections to connectivitycheck.gstatic.com and replying to the client /generate_204 which tells the client its not behind a captive portal...so the device doesnt listen to the redirect.

*webauthRedirect: Dec 14 16:42:32.142: 40:4e:36:23:85:c5- parser host is connectivitycheck.gstatic.com
*webauthRedirect: Dec 14 16:42:32.142: 40:4e:36:23:85:c5- parser path is /generate_204

Has anyone resolved this issue yet?

Re: WebAuth redirect does not work WLC/ISE

Jason Kunst — Mon, 17 Dec 2018 18:58:13 GMT

Have you tried disabling captive portal detection?

https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-5/config-guide/b_cg85/wlan_security.html#d170576e27598a1635

Re: WebAuth redirect does not work WLC/ISE

Josh.Kurtz — Mon, 17 Dec 2018 22:12:24 GMT

No unfortunately this didnt work, see the attached logs, no matter what I do, androids are bypassing the web auth acl and thinking they are online?? (the below acl also allowed dns...that was removed for testing...that isnt the issue)

...the more urls we see, we try and block...but we cant seem to block *.google.com/gen_204

Source Destination Source Port Dest Port
Index Dir IP Address/Netmask IP Address/Netmask Prot Range Range DSCP Action Counter
------ --- ------------------------------- ------------------------------- ---- ----------- ----------- ----- ------- -----------
1 Any 0.0.0.0/0.0.0.0 (ip removed for security)/255.255.255.255 Any 0-65535 0-65535 Any Permit 22
2 Any (ip removed for security)/255.255.255.255 0.0.0.0/0.0.0.0 Any 0-65535 0-65535 Any Permit 18

DenyCounter : 469

URLs configured in this ACL
---------------------------
*.connectivitycheck.android.com/generate_204
*.connectivitycheck.gstatic.com/generate_204
*.google.com/generate_204
*.clients3.google.com/generate_204
*.check.googlezip.net/connect
*.connectivitycheck.gstatic.com/favicon.ico
*.connectivitycheck.android.com
*.clients3.google.com
*.connectivitycheck.gstatic.com
*.google.com/gen_204

Re: WebAuth redirect does not work WLC/ISE

Jason Kunst — Mon, 17 Dec 2018 22:53:13 GMT

If captive portal bypass is disabled and still unable to get auto browser does the standard browser work going to an http site? Try enroll.cisco.com

Also work through tac

Re: WebAuth redirect does not work WLC/ISE

Josh.Kurtz — Mon, 17 Dec 2018 23:58:36 GMT

I dont think its the captive portal itself thats the issue, android devices seem to be fooling the controller into getting a response from a cisco site that is clearly not in the redirect url, see the below link:

https://socifi-doc.atlassian.net/wiki/spaces/SC/pages/94371841/DNS+Workaround+to+keep+Android+Splash+Page+and+the+Captive+Portal+Notification+active

The android phone is sending a port 80 request to http://connectivitycheck.gstatic.com through the controller before its authenticated...somehow the controller is allowing that and proxies the request to the site for the client, and the controller returns a \generate204 to the android...which makes the androud believe its not behind a captive portal...the android wont accept the redirect, which is the crux of the issue.

And this network is 100% external so we dont have control over dns servers.

Thanks for the help

Re: WebAuth redirect does not work WLC/ISE

Josh.Kurtz — Mon, 07 Jan 2019 23:26:11 GMT

Any ideas on what other levers I should pull to continue troubleshooting?

Thanks again for all the help!

Re: WebAuth redirect does not work WLC/ISE

Jason Kunst — Tue, 08 Jan 2019 15:38:13 GMT

Yes please work through the tac

Re: WebAuth redirect does not work WLC/ISE

cassiohonorio — Tue, 09 Apr 2019 20:03:46 GMT

Did you find any solutions to this problem? I have the same problem and the TAC could not find a solution

@Jason Kunst wrote:
Yes please work through the tac

Re: WebAuth redirect does not work WLC/ISE

Jason Kunst — Wed, 10 Apr 2019 15:50:26 GMT

If tac can’t find did they escalate? Seems to be wireless issue as well