topic Re: Issues with ISE hotspot and self registration portals with apple devices in Network Access Control

Issues with ISE hotspot and self registration portals with apple devices

n-russell-biggie — Wed, 09 Jan 2019 12:23:42 GMT

Hello,

I have configured ISE 2.4 to create wifi hotspots and self registration access. We user a WLC 2504 controller software version 8.5.

Everything works fine with windows devices and android devices which get correctly redirected to ISE portal pages. However, with the iphone we get errors. The phone connects to the ssid but then gives an error as below:

Error Opening Page - "Hotspot login cannot open the page because the server cannot be found". I believe this is trying to go to captive.apple.com. My redirect ACL on the WLC allows access to DNS and also to the ISE server. Do I need to add access to captive.apple.com in the ACL?

Another point is that the ise server has a certificate signed by a CA that is not a publicly trusted CA. I have added the root CA to my trusted certs on the iphone but still the same issue. I have also enabled web-auth captive-bypass and rebooted the WLC but still the same issues.

Any help would be great.

Thanks in advance

Nick

Re: Issues with ISE hotspot and self registration portals with apple devices

Jason Kunst — Wed, 09 Jan 2019 13:47:43 GMT

Yes likely the Apple Captive network assistant is not liking the self signed cert.

I recommend reviewing the guest guide under http:://cs.co/ise-guest<>

And also enabling captive portal bypass on the controller to suppress the CNA so the regular browser is used
https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-5/config-guide/b_cg85/wlan_security.html

Look for Captive Portal Bypass

Information About Captive Bypassing

Long term you will want to allow users to have a seamless flow and disabling it

Re: Issues with ISE hotspot and self registration portals with apple devices

n-russell-biggie — Wed, 09 Jan 2019 14:18:55 GMT

Many thanks Jason,

I have enabled captive bypass on the WLC. I am able to get a step further, so obviously I do not get automatically redirected to ise, however when I open a browser I do get redirected to ISE but that is as far as I can get as it tells me there is an issue with he certificate. I do not get the option to trust or add the certificate for ISE so I get stuck here.

The domain name is xxxxxxx.local. I have read somewhere that iphones do not like a .local domain.

Any other help would be great.

Thanks

Nick

Re: Issues with ISE hotspot and self registration portals with apple devices

Jason Kunst — Wed, 09 Jan 2019 14:30:43 GMT

Correct Apple doesn’t like that. Would recommend trying something else. We use a fake domain like securitydemo.net. And a well known cert, otherwise Apple devices won’t go through BYOD flow as well. This isn’t an ise issue.

Re: Issues with ISE hotspot and self registration portals with apple devices

n-russell-biggie — Wed, 09 Jan 2019 14:56:07 GMT

Thats great, thanks Jason. I will give this a try and let you know how I got on.

Cheers

Nick

Re: Issues with ISE hotspot and self registration portals with apple devices

briankk1582 — Thu, 01 Aug 2019 21:41:06 GMT

Hi Russell, can I ask what the results of your testing were?

Re: Issues with ISE hotspot and self registration portals with apple devices

Jason Kunst — Tue, 20 Aug 2019 17:24:11 GMT

thanks please let me know

Re: Issues with ISE hotspot and self registration portals with apple devices

ganiabdullahgenderang — Mon, 02 Dec 2019 09:30:45 GMT

Hi Jason,

i facing same issue, i try to change certificate selfsigned using xxx.com

the result, still same in apple device. " hotspot login cannot open the page because the server cannot be found "

i try to using browser its working normally.

is there any advice ?

thanks

Re: Issues with ISE hotspot and self registration portals with apple devices

Jason Kunst — Mon, 02 Dec 2019 11:43:38 GMT

Are you saying you’re using self signed certificate?

Apple captive network browser assistant doesn’t like that likely

Re: Issues with ISE hotspot and self registration portals with apple devices

ganiabdullahgenderang — Mon, 02 Dec 2019 14:15:19 GMT

hi Jason,

yes, i am using selfsigned certificate.
earlier everything running well.
and now apple device cannot using CNA.

so, we need using public certificate ?

thanks

Re: Issues with ISE hotspot and self registration portals with apple devices

Jason Kunst — Mon, 02 Dec 2019 17:41:31 GMT

that's correct, self-signed certificate is not supported in the guest flow for production as many browsers have issues with them

check out guest guide
https://community.cisco.com/t5/security-documents/ise-guest-access-prescriptive-deployment-guide/ta-p/3640475
and certificate guide
https://community.cisco.com/t5/security-documents/how-to-implement-digital-certificates-in-ise/ta-p/3630897